{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bd3fa0f4-d0ef-59cb-ac9b-fd1cc77e51a9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.0.8-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@2.0.8-tuxcare.6", "version": "2.0.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.0.8", "type": "library", "version": "2.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:e0a11666-eb76-5e51-be74-f80b83bfdd30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-26870 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5b66ce84-3efc-5bf1-bd2b-a32c4b9c4574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2e705d3d-374a-53f3-b7b1-27007f4c3dbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:81bf2b7a-acaa-5166-9588-50e4e6e99325", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:6a2323e7-ce18-5de9-8507-67b2311a5ac9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ee4fba4d-a6e1-5f9f-95da-c6f782235b92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:03ca22bd-f2fe-5740-aec3-3246ba20af50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:708d37c1-de6c-542c-afe5-cad3e6759b61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:bfb107e6-0dec-56b0-9303-550c98822ee3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:60da384b-36cc-539a-a892-b1a904df75de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:1552987f-0219-53fb-8b6d-8441d8667c58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fbf9efad-cab1-54a1-8fe8-236743536567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fb03a3f3-00af-5df9-a31c-1405f7321ad6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a6ba6a40-fe84-5352-bb8c-0de9f96845c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:11128a17-5628-57e7-b316-692915e0d375", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c22fd385-e240-5d45-8fab-d2534b764e92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f741048d-da93-5277-9b85-9cc88936eaba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:97c11f26-437a-5879-9fb2-75ce17ce89c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:e28b78b0-15c9-52cf-9b13-e4141a338afd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.0.8-tuxcare.6 of dompurify. not_affected \u2014 DOMPurify version 2.0.8 is NOT affected by CVE-2026-66010 (GHSA-c2j3-45gr-mqc4). The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which does not exist in this version. Version 2.0.8 predates the TypeScript rewrite (uses JavaScript src/purify.js, not src/purify.ts) and the introduction of CUSTOM_ELEMENT_HANDLING. All surviving elements in version 2.0.8 go through the...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:090f5d5f-f180-52bf-a7a5-b94673f8664b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f7f5c30a-6f62-5711-a0c3-e6bd69126870", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f4ff9d72-96f4-561e-843d-fad1e10d7326", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:6ab6ad4a-ca52-57c4-8e9c-0a3ac6049a71", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.0.8-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3e73fee9-bfa5-5046-ab34-fac1b102dfdc", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.0.8-tuxcare.6." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ], "bom-ref": "urn:uuid:05c51aaa-09be-5b1b-8d96-29aac8eed10e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 2.0.8-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.6" } ] }