{
  "@id": "urn:uuid:eebbef39-8ff1-461e-94f1-b29429facaff",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T16:32:54.814880+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2024-45801 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-45801"
      },
      "action_statement": "Vulnerability CVE-2024-45801 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2024-47875 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-47875"
      },
      "action_statement": "Vulnerability CVE-2024-47875 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2025-26791 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-26791"
      },
      "action_statement": "Vulnerability CVE-2025-26791 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-26T23:23:48.785681+00:00",
      "status_notes": "Vulnerability CVE-2026-116802 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-116802"
      },
      "action_statement": "Vulnerability CVE-2026-116802 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-116803 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-116803"
      },
      "action_statement": "Vulnerability CVE-2026-116803 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-20T06:52:00.133366+00:00",
      "status_notes": "Vulnerability CVE-2026-41238 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41238"
      },
      "action_statement": "Vulnerability CVE-2026-41238 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-29T16:32:54.814880+00:00",
      "status_notes": "Vulnerability CVE-2026-41239 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41239"
      },
      "action_statement": "Vulnerability CVE-2026-41239 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T14:25:00.578824+00:00",
      "status_notes": "Vulnerability CVE-2026-41240 does not affect version 3.0.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41240"
      },
      "impact_statement": "not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-49458 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-49458"
      },
      "action_statement": "Vulnerability CVE-2026-49458 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-49459 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-49459"
      },
      "action_statement": "Vulnerability CVE-2026-49459 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-29T16:32:54.814880+00:00",
      "status_notes": "Vulnerability CVE-2026-49978 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-49978"
      },
      "action_statement": "Vulnerability CVE-2026-49978 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-20T06:52:00.133366+00:00",
      "status_notes": "Vulnerability CVE-2026-65898 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-65898"
      },
      "action_statement": "Vulnerability CVE-2026-65898 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-65899 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-65899"
      },
      "action_statement": "Vulnerability CVE-2026-65899 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-20T06:52:00.133366+00:00",
      "status_notes": "Vulnerability CVE-2026-65900 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-65900"
      },
      "action_statement": "Vulnerability CVE-2026-65900 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-65901 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-65901"
      },
      "action_statement": "Vulnerability CVE-2026-65901 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-29T16:32:54.814880+00:00",
      "status_notes": "Vulnerability CVE-2026-65902 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-65902"
      },
      "action_statement": "Vulnerability CVE-2026-65902 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:31:00.155648+00:00",
      "status_notes": "Vulnerability CVE-2026-65903 does not affect version 3.0.4 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-65903"
      },
      "impact_statement": "not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:28:00.173627+00:00",
      "status_notes": "Vulnerability CVE-2026-65912 does not affect version 3.0.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65912"
      },
      "impact_statement": "not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-65913 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-65913"
      },
      "action_statement": "Vulnerability CVE-2026-65913 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-20T06:52:00.133366+00:00",
      "status_notes": "Vulnerability CVE-2026-65914 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-65914"
      },
      "action_statement": "Vulnerability CVE-2026-65914 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-20T06:52:00.133366+00:00",
      "status_notes": "Vulnerability CVE-2026-66010 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-66010"
      },
      "action_statement": "Vulnerability CVE-2026-66010 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability CVE-2026-75838 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-75838"
      },
      "action_statement": "Vulnerability CVE-2026-75838 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:40:27.789940+00:00",
      "status_notes": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "GHSA-55q2-fjhq-7xh7"
      },
      "action_statement": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:03:00.181592+00:00",
      "status_notes": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-6688-9rhm-gjv2"
      },
      "action_statement": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-25T12:17:33.862818+00:00",
      "status_notes": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-c6gr-qvv4-5v3f"
      },
      "action_statement": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4.",
      "vulnerability": {
        "name": "GHSA-jxrp-r7gx-q4j8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-27T11:54:47.755813+00:00",
      "status_notes": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-mrv2-3pqr-j5jr"
      },
      "action_statement": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.4."
    }
  ]
}