{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:62d7f529-d1e1-5239-94d5-3e3630e8b17a",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/dompurify@3.0.3",
      "type": "library",
      "name": "dompurify",
      "version": "3.0.3",
      "purl": "pkg:npm/dompurify@3.0.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:b39bb626-e756-536b-83c7-3984d3876c17",
      "id": "CVE-2026-65900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3 of dompurify."
      },
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:139a4c01-4d7a-5519-b0ad-7624090edf63",
      "id": "CVE-2026-65901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3 of dompurify."
      },
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e5d65a5-0a30-52f8-b44d-94c4bf7c678b",
      "id": "CVE-2026-65903",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..."
      },
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:905e6301-bda3-50c3-b47c-5f2d520e6062",
      "id": "GHSA-55q2-fjhq-7xh7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3 of dompurify."
      },
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@3.0.3"
    }
  ]
}