{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:884bb2d5-6314-5acc-9e97-bf73761ec67b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.0.8-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@2.0.8-tuxcare.5", "version": "2.0.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.0.8", "type": "library", "version": "2.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:dddb52aa-5b84-56a0-93cb-8a6175b99d35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-26870 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7b09ad54-e1eb-5b2b-8675-81774eeb5e6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c3d4bed8-8e86-51b7-b96c-076dafd6c434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e6e1e179-5271-5d19-8a8d-a30805858ec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:95b84588-47bf-59c7-86a3-7a62cc024bb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:25e6171b-2d5b-5b9a-89f2-df0c53ecac5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d811527f-d899-532f-9664-b9c33d854b6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d610f957-39ed-5c82-b4b6-52cd175ab44b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f1603127-4a73-5021-a704-65acb860087c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2bca212f-5b12-57c5-852e-47aebfede6d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:40c17738-18df-517b-8a5f-734a4835edc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:51627688-ec13-526a-b054-c520abb71e99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:70783656-3063-53ab-80fc-4512ee2b399b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:be49982a-8df3-5b6c-a352-152ea266817e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:80136b71-b891-5ee7-afdb-08328e85b524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:680fcdbe-c423-5d6f-bee2-316f1a3fe745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:459943e2-10f8-5e43-895e-88efc64a4f6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:18db70ed-790d-5ebf-b269-894fecdc36f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:be8b38ec-861c-5f0d-b539-b13b403a3391", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.0.8-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify version 2.0.8 is NOT affected by CVE-2026-66010 (GHSA-c2j3-45gr-mqc4). The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which does not exist in this version. Version 2.0.8 predates the TypeScript rewrite (uses JavaScript src/purify.js, not src/purify.ts) and the introduction of CUSTOM_ELEMENT_HANDLING. All surviving elements in version 2.0.8 go through the...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7c5635ae-a217-589b-88d6-d677f9348096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4e024d71-1e32-5704-b844-4d42266bbd01", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:372ceeed-a44e-5219-970b-0a185fff14ba", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.0.8-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c93ca5fd-4c53-54cf-affd-ba7ed3797ab7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 2.0.8-tuxcare.5 of dompurify, and is fixed in 2.0.8-tuxcare.6." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c283ae54-8878-5183-a1bb-5d9214c24755", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.0.8-tuxcare.5." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f6957c02-fd76-5569-baa1-ec8f46594de7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 2.0.8-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.5" } ] }