{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7060ee75-d030-5aa8-a489-ca253600c6e9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.4", "version": "3.0.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:f98d7dcd-ec5d-594d-ab6d-bee058c43263", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:a2b2346f-3351-556d-9340-93c7984a6f41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:a5dc0382-20a4-5606-a25e-448675565cce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:8d5f4e13-2292-5487-bf38-972f0a194d98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:09106608-7bee-57f9-8f9e-9f6b39ceb5db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:730b0116-3b88-5a69-a7a9-fba259961d4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:e557ae17-9a0a-5252-b411-56de0e2efaba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:70d03e6d-079d-5979-ad76-4c597d6921eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:b4026da7-b52b-5ddf-9a98-1186a8aefcdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:74303126-9393-5ddc-bac8-201a50f6105f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:89d89da3-b20a-5eee-9783-6ebf198b070d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:d1605e81-95a1-5861-8c1b-9254b7c9ee45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:79b4bcb2-db8a-507d-8d64-0927f214f179", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:014af6f7-f407-5c83-9890-c6a58d6a59d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:4ed72dd1-830e-5082-822a-b3842f774482", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.4 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:90910f14-d9a6-50b4-acc8-6d1966fffb4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:b597f27a-1279-5d73-bbb4-b13be16865a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:f68c2401-c01c-5cf9-b1c5-a656decc19f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:490825dc-e6a4-5afe-8b02-234377eb028b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:0b9384a5-7b45-5f97-a925-ce741ad3d19e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:6780db53-5237-5179-8a81-dd79b285783f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.1." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:2fc34ab4-2858-5904-9df8-66fb7c5f5ca8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.3." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:50c47ee5-d82d-5b68-bf18-27d168ffd873", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4" } ], "bom-ref": "urn:uuid:3771a9db-b60f-5ac9-8c38-62b454be35b0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.4" } ] }