{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1af295b0-e17e-5d04-82a2-141e5b8cb19f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@xmldom/xmldom", "purl": "pkg:npm/%40xmldom/xmldom@0.7.13", "type": "library", "bom-ref": "pkg:npm/%40xmldom/xmldom@0.7.13", "version": "0.7.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-34601", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:08cf387d-6024-59de-ba0c-3c67a222cd45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34601 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.2." } }, { "id": "CVE-2026-41672", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:b767d98b-dc23-5de8-8a89-ebdcbb801b03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41672 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-41673", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:390414e5-3011-5b95-9268-17e95714c31e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41673 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-41674", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:f9cc7c31-68d8-5356-b6a2-c36be7912c42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41674 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-41675", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:235011a3-b3ec-57aa-9e53-9ec4a3a3509e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41675 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83605", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:91662c44-c156-5eb6-babf-b0704ed3b9d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83605 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83606", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:27ca37ed-4d01-5f9f-91cd-495579b7d42b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-83606 does not affect version 0.7.13 of @xmldom/xmldom. Version 0.7.13 is NOT affected by CVE-2026-83606. The vulnerable code (lib/grammar.js with the quadratic-backtracking PI regex) does not exist in this version. Version 0.7.13 uses a different, safe PI parsing code path (parseInstruction in lib/sax.js:591-604) that bounds the search with indexOf('?>') BEFORE applying any regex, preventing the quadratic behavior. The CVE explicitly states that versions \u22640.8.13 use the indexOf-bounded path and are not affected. Testing confirms: the same 32KB unterminated PI input that causes >1000ms stall in vulnerable 0.9.x versions processes in 0.078ms in version 0.7.13.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-83607", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:bb8114fe-f477-507c-b0b2-a86bb6d2868e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83607 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83608", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:cb388c55-43a3-5933-a6ef-66eaade89602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83608 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83609", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:9ac77d24-1b19-5273-96cf-0c2c28ec3624", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83609 affects version 0.7.13 of @xmldom/xmldom." } }, { "id": "CVE-2026-83610", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:5abf9d2f-28e2-51ff-8455-5094a8f86170", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83610 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83611", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:41ebe2ec-540f-5737-913c-90f00d82b955", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83611 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83612", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:aa0442ad-bc5a-58f1-8630-0db1456a48f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-83612 does not affect version 0.7.13 of @xmldom/xmldom. CVE-2026-83612 describes a quadratic HTML raw-text output amplification vulnerability affecting xmldom 0.9.x (0.9.0-beta.1 through 0.9.11). The target version 0.7.13 is NOT affected. Empirical testing confirms no amplification occurs (1.0x ratio, linear growth), and architectural analysis shows the vulnerable code pattern does not exist in this version. The CVE explicitly states \"Only the 0.9.x line is affected\" and \"The 0.8.x line is **not** affected\" \u2014 0.7.13 predates 0.8.x and uses an older parseHtmlSpecialContent implementation that lacks the unconditional text emission mechanism introduced in the 0.9.0-beta.1 refactoring.", "justification": "code_not_present" } }, { "id": "CVE-2026-83613", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:cb92a7a0-4a0a-5dcb-8960-be1e418b6d38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83613 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83614", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:13cc86e1-53c8-5488-aa5b-9832f35b2de1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83614 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83615", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:63942319-9a2d-58b5-8441-f7f374c334fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83615 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83616", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:5f959456-9976-5d97-be20-daf283453ee3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83616 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } }, { "id": "CVE-2026-83618", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:e2f53f86-eda2-5084-98ef-d0d5c463c8cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-83618 does not affect version 0.7.13 of @xmldom/xmldom. Version 0.7.13 is not affected by CVE-2026-83618. The vulnerability requires the `requireWellFormed` serializer feature and the `lib/grammar.js` module with m-flagged regexp validators, both introduced in version 0.9.10 (969 commits after 0.7.13). The CVE explicitly scopes to \"Only @xmldom/xmldom 0.9.x\" and describes a bypass of the GHSA-f6ww-3ggp-fr8h mitigation that does not exist in 0.7.13. Version 0.7.13 performs spec-compliant verbatim serialization without validation, which is the expected default behavior per W3C DOM Parsing specification.", "justification": "code_not_present" } }, { "id": "CVE-2026-83619", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ], "bom-ref": "urn:uuid:a934c0af-e1cf-5df7-8fb9-f24a5fedab14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83619 affects version 0.7.13 of @xmldom/xmldom, and is fixed in 0.7.13-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.7.13" } ] }