{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1654441f-bd80-520c-9a46-92c8ddd4d8a6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@xmldom/xmldom", "purl": "pkg:npm/%40xmldom/xmldom@0.9.8", "type": "library", "bom-ref": "pkg:npm/%40xmldom/xmldom@0.9.8", "version": "0.9.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-34601", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:ec397b44-91a3-542b-867e-a49cc029815f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34601 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-41672", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:f4b3a10e-7991-53c6-a915-6cf716b3cc23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41672 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-41673", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:b5aa61e6-5719-5956-b14e-15e6985b3c1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41673 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.1." } }, { "id": "CVE-2026-41674", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:29cf9fcd-10b5-57fc-9fa9-db92cbe9e34a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41674 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-41675", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:3811dcfa-9545-5c63-8997-20d27a1d0303", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41675 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-83605", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:26745bfe-fb86-57bb-8b6d-1cea1a5aad41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83605 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-83606", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:bc9e4974-b497-5a35-a3bd-cc08ed109881", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83606 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.3." } }, { "id": "CVE-2026-83607", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:5aee9d23-af7e-5aa7-8118-3e964649ef8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83607 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-83608", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:c8ad6fc2-9404-5574-9791-439077172a8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83608 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-83609", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:36581224-54fa-5713-923f-a35790479ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83609 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-83610", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:dd1b25e2-dbd8-5143-9f58-4f7e976b7f30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83610 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-83611", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:957518af-43b1-5625-9b61-03e7f2df1364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83611 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.1." } }, { "id": "CVE-2026-83612", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:a74a4009-4e07-5fd9-ad0c-84c4610f3118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83612 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.4." } }, { "id": "CVE-2026-83613", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:8ebf167c-a840-5bd3-86b0-6b14ea222a69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83613 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.1." } }, { "id": "CVE-2026-83614", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:f50b8a31-b6cf-51ed-8626-0995a891fc7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83614 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-83615", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:ee0472cb-a02f-5433-8d96-6dde53b0a81b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83615 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "CVE-2026-83616", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:6b4fc1b9-3a5b-51a1-9338-d047b811f2ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-83616 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.5." } }, { "id": "CVE-2026-83618", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:72ca4776-4c0a-50fe-ac10-e5b42923eeb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-83618 does not affect version 0.9.8 of @xmldom/xmldom. Version 0.9.8 is not affected by CVE-2026-83618. This CVE describes a bypass of the `requireWellFormed` serializer check for DocumentType publicId/systemId, which was introduced in version 0.9.10 as a fix for GHSA-f6ww-3ggp-fr8h. Version 0.9.8 predates this security feature entirely\u2014the XMLSerializer.serializeToString() method signature only accepts (node, nodeFilter) parameters with no requireWellFormed option. The vulnerability chain (malicious publicId with line terminator \u2192 bypassed requireWellFormed validation \u2192 injected markup in output) cannot exist in a version that lacks the validation step. While 0.9.8 does have the m-flagged reg() builder and does serialize publicId/systemId without any validation, this represents a general lack of protection rather than the specific bypass vulnerability described in the CVE.", "justification": "code_not_present" } }, { "id": "GHSA-6gmq-8vp8-gcm6", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:f15833c2-22a4-5a5b-8955-e19b5aea0cc3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6gmq-8vp8-gcm6 affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } }, { "id": "GHSA-965w-775f-mr7g", "affects": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ], "bom-ref": "urn:uuid:7a8e664c-e0af-5a05-a9e5-ac3ea5f5d08d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-965w-775f-mr7g affects version 0.9.8 of @xmldom/xmldom, and is fixed in 0.9.8-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:npm/%40xmldom/xmldom@0.9.8" } ] }