{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d29363f6-45f6-5882-8616-016390f455dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.4-tuxcare.1", "version": "3.0.4-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4", "type": "library", "version": "3.0.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e161ed5a-9932-5888-82e0-afe99096bda2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:02c7d45b-6cf8-5f83-bfed-f877174ab5b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c3078b57-6e03-54e2-a437-f906d0fb031c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:51043e7b-ed27-5fc0-b60b-286b02c048cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:78e5e228-0b4e-5e00-92f2-c8fb8b4797e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:72530906-8483-5657-bc27-33d17e7297de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.4-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:5fbe3261-b7a4-5f8f-a13b-d546b939c15e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f35567fb-5f4d-5e54-bc70-2a9422b77bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:af46f17e-8d43-591d-97db-2159dfce3efc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c0715359-9975-5251-9931-9b2e9cca14d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:eadbd6cb-2537-5cae-8de6-224ff8be8b19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f219699e-4129-5a50-af8a-39eff391d46a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c1ee8c30-f981-5727-864d-d34a09df3b85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:3c01d4fd-0971-53ce-92e0-839a9cfdbe20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c6157c7f-f6fb-5799-b8d3-8b02cf718605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.4-tuxcare.1 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:676196aa-b7ca-5ad2-8302-3a8653f85021", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.4-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:59ecef42-cb49-5935-832c-38553d50376d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:89d608b1-01cb-5ca1-abb7-fb0caaed107c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:7e783759-ed58-50c3-8633-f2610f014e3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:099e09ad-58fa-572d-919d-3bcde42342a4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:24a3949f-24fe-5204-b431-5d3657d6203c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:94025306-aa3f-5940-bb28-ed49e77633bf", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.3." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:ae5629b2-a54b-586c-b6b8-f69d5f65d27c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4-tuxcare.1." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:2d112d93-c458-51d1-8be8-000c22c2802a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.4-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ] }