{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e1fc81ad-bcf1-5fca-b903-b30c1f12bc14", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.7-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.7-tuxcare.7", "version": "3.2.7-tuxcare.7", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.7", "type": "library", "version": "3.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d7c962c9-4c76-5981-b281-22bc22b3cbc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:69944b50-3601-5e22-8396-712dac0f3f81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116802 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8a58fd04-eb09-5827-a822-26ae0e7fa0ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8688a352-3892-53ab-bb45-dba3de78ca8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:7edbc46b-175a-55ff-b7b2-e1b8732ef022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:99495289-9a70-57d3-a35e-457e368b5587", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.2.7-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires the EXTRA_ELEMENT_HANDLING.tagCheck feature and function-based ADD_TAGS configuration, which were introduced in version 3.3.0. Version 3.2.7 only supports array-based ADD_TAGS and lacks the EXTRA_ELEMENT_HANDLING mechanism entirely, making the attack vector described in the CVE impossible to trigger.", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ad605e61-5139-5ee9-8dcb-9e56101600cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:cea900bf-275a-5667-88c8-57e082835088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:fad625ec-385e-5e6d-98f1-2dd0f1d9eea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:40474d1d-e08d-5331-a9b7-77831247ebd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:6ffada32-7ec7-5f9e-8634-296a9b905fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:c04a4f67-ce71-5217-9674-2fa8f5b5669c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:72f0f6c6-2a65-5027-be1b-7134f20e153f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1b631b5e-c7d0-576b-8ced-3b4cfceca4c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:f4d48120-0b83-597c-9252-e6a239260bb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.7-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify 3.2.7 is NOT affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck, a feature that allows ADD_TAGS to be used as a function, which was introduced in later versions (v3.3.3+). Version 3.2.7 only supports ADD_TAGS as a string array and does not have the EXTRA_ELEMENT_HANDLING mechanism. The existing CUSTOM_ELEMENT_HANDLING in 3.2.7 correctly prioritizes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:33456646-1393-5030-96e1-86556db11197", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.7-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is not affected by CVE-2026-65912. The vulnerability requires ADD_ATTR to be provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck, which bypasses URI validation when returning true. This function-based ADD_ATTR feature was introduced in version 3.3.0 (PR #1150) AFTER the 3.2.7 release. The target version only supports ADD_ATTR as a string array (typ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:859b3bc4-6827-5375-a7d2-c901873d7f9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1cc9bf1b-76dc-565c-af55-bc5e895935a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ee2f0628-4020-5ae5-b763-01d5ddc08830", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:6a524c54-d536-5a78-bb20-cdcc58c5f574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:246c06cd-3ec8-5a63-bb5f-37b453e86553", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:179ea1ac-9319-51a1-90b4-390db96841f3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:f4110043-431b-5b7e-b7c5-a8b9cb2bbfcd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:50ca828e-4f5f-55b0-81d2-e79b739bc675", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:4507ad49-4cbf-5062-b4ba-7ae33f66eeef", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.7-tuxcare.7." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d4e95404-b495-5409-90bd-ebb3a8fd4164", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.2.7-tuxcare.7 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ] }