{ "@id": "urn:uuid:01675a5c-5dd6-4d35-b592-2471f7e913e8", "role": "Document Creator", "author": "https://tuxcare.com", "version": 23, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:31:01.936791+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-29T16:31:01.936791+00:00", "status_notes": "Vulnerability CVE-2024-45801 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.8.", "vulnerability": { "name": "CVE-2024-45801" }, "action_statement": "Vulnerability CVE-2024-45801 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-23T13:02:19.319023+00:00", "status_notes": "Vulnerability CVE-2024-47875 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.4.", "vulnerability": { "name": "CVE-2024-47875" }, "action_statement": "Vulnerability CVE-2024-47875 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-19T00:25:13.166713+00:00", "status_notes": "Vulnerability CVE-2025-26791 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2025-26791" }, "action_statement": "Vulnerability CVE-2025-26791 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-26T23:23:48.785681+00:00", "status_notes": "Vulnerability CVE-2026-116802 affects version 3.0.6 of dompurify.", "vulnerability": { "name": "CVE-2026-116802" }, "action_statement": "Vulnerability CVE-2026-116802 affects version 3.0.6 of dompurify." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-27T10:36:16.517227+00:00", "status_notes": "Vulnerability CVE-2026-116803 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.6.", "vulnerability": { "name": "CVE-2026-116803" }, "action_statement": "Vulnerability CVE-2026-116803 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-19T00:25:13.166713+00:00", "status_notes": "Vulnerability CVE-2026-41238 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-41238" }, "action_statement": "Vulnerability CVE-2026-41238 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-29T16:31:01.936791+00:00", "status_notes": "Vulnerability CVE-2026-41239 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.8.", "vulnerability": { "name": "CVE-2026-41239" }, "action_statement": "Vulnerability CVE-2026-41239 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-16T14:29:00.163831+00:00", "status_notes": "Vulnerability CVE-2026-41240 does not affect version 3.0.6 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41240" }, "impact_statement": "not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-25T11:54:35.259645+00:00", "status_notes": "Vulnerability CVE-2026-49458 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "CVE-2026-49458" }, "action_statement": "Vulnerability CVE-2026-49458 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-26T21:12:00.118033+00:00", "status_notes": "Vulnerability CVE-2026-49459 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "CVE-2026-49459" }, "action_statement": "Vulnerability CVE-2026-49459 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-27T16:49:56.911057+00:00", "status_notes": "Vulnerability CVE-2026-49978 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.7.", "vulnerability": { "name": "CVE-2026-49978" }, "action_statement": "Vulnerability CVE-2026-49978 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-19T00:25:13.166713+00:00", "status_notes": "Vulnerability CVE-2026-65898 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-65898" }, "action_statement": "Vulnerability CVE-2026-65898 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-25T11:54:35.259645+00:00", "status_notes": "Vulnerability CVE-2026-65899 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "CVE-2026-65899" }, "action_statement": "Vulnerability CVE-2026-65899 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-19T00:25:13.166713+00:00", "status_notes": "Vulnerability CVE-2026-65900 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-65900" }, "action_statement": "Vulnerability CVE-2026-65900 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-25T11:54:35.259645+00:00", "status_notes": "Vulnerability CVE-2026-65901 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "CVE-2026-65901" }, "action_statement": "Vulnerability CVE-2026-65901 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-29T16:31:01.936791+00:00", "status_notes": "Vulnerability CVE-2026-65902 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.8.", "vulnerability": { "name": "CVE-2026-65902" }, "action_statement": "Vulnerability CVE-2026-65902 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-65903 does not affect version 3.0.6 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-65903" }, "impact_statement": "not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-16T13:29:00.177417+00:00", "status_notes": "Vulnerability CVE-2026-65912 does not affect version 3.0.6 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-65912" }, "impact_statement": "not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-19T00:25:13.166713+00:00", "status_notes": "Vulnerability CVE-2026-65913 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-65913" }, "action_statement": "Vulnerability CVE-2026-65913 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-19T00:25:13.166713+00:00", "status_notes": "Vulnerability CVE-2026-65914 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-65914" }, "action_statement": "Vulnerability CVE-2026-65914 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-16T15:15:00.151476+00:00", "status_notes": "Vulnerability CVE-2026-66010 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.2.", "vulnerability": { "name": "CVE-2026-66010" }, "action_statement": "Vulnerability CVE-2026-66010 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-25T11:54:35.259645+00:00", "status_notes": "Vulnerability CVE-2026-75838 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "CVE-2026-75838" }, "action_statement": "Vulnerability CVE-2026-75838 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-25T13:04:00.186796+00:00", "status_notes": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "GHSA-55q2-fjhq-7xh7" }, "action_statement": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-14T14:30:26.045812+00:00", "status_notes": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-6688-9rhm-gjv2" }, "action_statement": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-25T11:54:35.259645+00:00", "status_notes": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5.", "vulnerability": { "name": "GHSA-c6gr-qvv4-5v3f" }, "action_statement": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6.", "vulnerability": { "name": "GHSA-jxrp-r7gx-q4j8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/dompurify@3.0.6", "identifiers": { "purl": "pkg:npm/dompurify@3.0.6" } } ], "timestamp": "2026-10-27T10:36:16.517227+00:00", "status_notes": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.6.", "vulnerability": { "name": "GHSA-mrv2-3pqr-j5jr" }, "action_statement": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.6." } ] }