{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8830cdbb-d47b-5177-bbf9-82ab1fde1a76", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.8", "version": "3.0.3-tuxcare.8", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3", "type": "library", "version": "3.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f8aa788b-6d2c-521c-97de-6aca5c56b0df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2ed6c48e-af52-5416-a686-d164552c7850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:baababa4-96a8-5867-a582-1d3dfdd0656f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:27ce6f77-27e1-5c55-a087-91a738019ebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9cbc3a83-2957-5305-97d8-2d8313eeb5dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:aea141b2-49b4-577e-920f-9e0b67c851dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:fbd0795e-68e1-5289-b637-e58e5d513941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:25784466-38e2-5b45-b5b5-0300c7986e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8a1877d4-fff3-5ad3-8a52-e1d4c636d61c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:31ea4724-52c9-5fa0-bfe7-710b461b9b13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:663d6255-3e85-532e-b402-1e11cc85fec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3987b730-6c5f-5a2c-9211-4f887a65f2a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:78bb1b28-0c3a-51e6-b84d-998868c2834a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:fc6720a6-5b6d-576e-aaa8-20972225ed9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:3572a406-2d6a-5acc-8e54-7c554df0a93e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9d1324ef-8f9e-55ef-af83-8567b79c5a4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.8 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:7a301da7-e4b4-5462-b5c1-581996601faf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:342c4bc9-aa96-5f10-95ec-1d4a67c6044d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b3b0410d-86e6-5fde-8607-e10cd821d89f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:5375987f-a385-5456-a474-512b22ad1a7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:5a496e1f-22b8-5d0f-bb91-4a5b2bc95d0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:eae65e57-a11e-551f-b1cd-8c0a341ba43d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:1a0379cf-17d3-5b01-a23a-54086848c7a0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2c650a1e-bfce-5921-aef8-5a8c36de1aa0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:88b91502-56dd-57cd-b8ac-1e910b68d825", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:35a3bebf-0534-50ae-a2cc-a511cfa35b10", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:7ffffbfb-ceab-50e7-ae11-72436aec9d26", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f0700c46-105e-5160-937a-23aa4ae64746", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:11a1441a-eec2-5c66-99e0-fd0dfa4f85a7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:321c49ab-5332-5b70-8566-c7796b2b1c64", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:300fa4cf-d42b-5bcc-8cb5-e385c4fcdc53", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f7978056-a625-50c5-a475-115ea1335fc9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:69f045b0-5caf-576d-b047-0ea731e55243", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.3-tuxcare.8." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:250c918a-5ff3-574f-bab5-b3998627690a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:5c6db97b-65b1-52cf-a51b-b5e2635356f6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.8 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e24dd449-c54a-59f1-ad9f-c076be49f79e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.8 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.8" } ] }