{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:851af719-9425-5067-95fe-fc883516a008", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@xmldom/xmldom", "purl": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4", "version": "0.9.8-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-34601", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f3a44790-199e-5d34-9b8a-300a179950a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34601 affects version 0.9.8-tuxcare.4 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-41672", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7ad5164b-9386-53e5-9a66-9c7c5f57cd28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41672 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-41673", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e232ab32-8112-5604-9f82-0cb1aa05e0b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41673 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-41674", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:415b7bd1-383b-518b-a6c7-63066c15aa4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41674 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-41675", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:eb31d4a8-9a40-5e7b-ba1a-e9d31b39d634", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41675 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83605", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2fd9ef37-f91a-5bda-b318-eac2c324abd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83605 affects version 0.9.8-tuxcare.4 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-83606", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b144ebe0-8941-57de-a293-541847e6d104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83606 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83607", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:257ad655-32f4-576c-9dc0-7319cbb08420", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83607 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83608", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:93d96b52-0bf4-55be-b36d-e2adfadadea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83608 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83609", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:bf0d898d-5c2a-516d-a7d9-6a7976e0290e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83609 affects version 0.9.8-tuxcare.4 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-83610", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:10af2f94-be40-5e5c-b2c4-a78a7d36636e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83610 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83611", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9e88bcd8-a11b-5755-8ab6-b1905a71ae4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83611 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83612", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a536af4c-11b1-5abc-987b-4b392e9493c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83612 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83613", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:eac282e8-51ad-592c-b832-cdc2427db3c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83613 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83614", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:37b40846-2ed3-59a7-937f-319d188934ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83614 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83615", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a9dff620-f3df-51f3-afee-5c72516820e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-83615 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "CVE-2026-83616", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8756b160-ffc9-583b-910c-a799a31b0e6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83616 affects version 0.9.8-tuxcare.4 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-83618", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6e1e285e-75d0-5c56-b263-169327d11ae0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-83618 does not affect version 0.9.8-tuxcare.4 of @xmldom/xmldom. Version 0.9.8 is not affected by CVE-2026-83618. This CVE describes a bypass of the `requireWellFormed` serializer check for DocumentType publicId/systemId, which was introduced in version 0.9.10 as a fix for GHSA-f6ww-3ggp-fr8h. Version 0.9.8 predates this security feature entirely\u2014the XMLSerializer.serializeToString() method signature only accepts (node, nodeFilter) parameters with no requireWellFormed option. The vulnerability chain (malicious publicId with line terminator \u2192 bypassed requireWellFormed validation \u2192 injected markup in output) cannot exist in a version that lacks the validation step. While 0.9.8 does have the m-flagged reg() builder and does serialize publicId/systemId without any validation, this represents a general lack of protection rather than the specific bypass vulnerability described in the CVE.", "justification": "code_not_present" } }, { "id": "GHSA-6gmq-8vp8-gcm6", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:12b565fb-88f4-535b-a975-da69b88c069b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6gmq-8vp8-gcm6 is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } }, { "id": "GHSA-965w-775f-mr7g", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ], "bom-ref": "urn:uuid:5ec8ee6c-bd42-598c-bd7d-36eb9a23f735", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-965w-775f-mr7g is fixed in version 0.9.8-tuxcare.4 of @xmldom/xmldom." } } ], "dependencies": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8-tuxcare.4" } ] }