{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5e6d93e7-fd01-5d74-a9c8-fff78944b715", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.4-tuxcare.3", "version": "3.0.4-tuxcare.3", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4", "type": "library", "version": "3.0.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:cb0e3337-d994-5575-a701-ae6e8f3018a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:f1225395-3785-5d1d-8ca7-ae7f240c386b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:022624ea-16e5-565f-a793-e822bf5e5b6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:dc2fef38-794a-5c3a-ac58-4ef6086d1680", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:680f3735-100f-5ffd-a3a2-7fd95231a8c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:65227708-5c23-574c-a541-c67399f3325e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.4-tuxcare.3 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:ba117efb-3b22-557c-9bb7-40e2800ff115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:d9295700-f52b-52b1-8f8a-2f8fe0656398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:dbaeed5a-dd10-5cbc-85a8-43444fce9b48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:ebab017b-944a-5d3c-b197-507076482aca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:85d6d0ba-cf83-5d29-b86a-9e6a45ac7b4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:fc7c29c5-7925-55b6-abbd-6b1a0208d677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:ca31ad98-3b03-5f1b-b4fd-803e525fa192", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:1379151f-e6cd-52d8-8345-cd3247890256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:4c47ee99-6269-51b2-924d-6e3a2d51ff00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.4-tuxcare.3 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:d2e01c74-c1c9-5ed6-8fbf-a626418ad686", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.4-tuxcare.3 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:aa2ce1a6-6e36-5199-887a-13ea6df5a321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:aab8d780-7174-538b-bd29-404d4a2b07a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:6e89e2b2-2e60-5e6a-be76-c6345e6bbaf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:0c5768e9-08eb-58f1-8113-625977b53a8a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:5977c75f-0657-5d29-a9c8-17d77a6ffb03", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:0ee738b1-a9e7-5cff-95f3-38949fed8f8e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.4-tuxcare.3 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:4852a676-d4e5-51da-8d12-b7c7d6b0725e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4-tuxcare.3." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ], "bom-ref": "urn:uuid:163ebbd2-03fd-5f93-b4ea-471e21bca3b7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.4-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.3" } ] }