{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5955000e-a7cf-5f3f-9aa7-736399b42245", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.5-tuxcare.2", "version": "3.0.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5", "type": "library", "version": "3.0.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d653e73d-3844-5b07-af82-5bfb96419dec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d3d04343-fd35-55e7-b57c-3631a12ce24a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:f80d735c-24f9-52fb-b5c6-da3aba46fd87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d30c0c9b-bdb1-5780-9b95-708ff33d0dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3af7c08f-8081-53ef-a72d-3b94f24c693f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2468cb36-f3bc-55a3-a701-e6195bbd412e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.5-tuxcare.2 of dompurify. not_affected \u2014 CVE-2026-41240 affects DOMPurify versions 3.3.0 and later that support function-based ADD_TAGS configuration. Target version 3.0.5 does not have this feature (introduced in 3.3.0, October 2025). The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck mechanism to bypass FORBID_TAGS checks via short-circuit evaluation - this mechanism is entirely absent from 3.0.5. Version 3.0.5 uses only arr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:cf435df3-34a5-565c-a1cd-eb888009e21f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:365d82ae-0bb6-5994-8002-01b5da951aee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:69d356b5-b731-5107-8775-4852df83c3db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:28ff007b-f45c-5753-8d67-bb77e4f4c801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:7840313c-f582-5a15-be9e-dddceeddd405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:5155229b-6d3c-55c8-95ec-f7fd6d507f9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:a3028a07-05ca-5666-b040-a2d587870a74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:4d337547-1fba-5aec-8d94-164fe0dd2e41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:61185fd5-0b62-551e-a805-57896cf8fa3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.5-tuxcare.2 of dompurify. not_affected \u2014 DOMPurify v3.0.5 is NOT affected by CVE-2026-65903. The vulnerability is a regression introduced between v3.0.5 and v3.3.3. In v3.3.3, the condition `!(tagCheck(tagName)) && (!ALLOWED_TAGS || FORBID_TAGS)` allows tagCheck to short-circuit the FORBID_TAGS check. Version 3.0.5 uses a different architecture with an explicit guard `!FORBID_TAGS[tagName]` at line 1019 that prevents forbidden tags fr...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:95af92e5-ba3e-59c7-9900-0665c94d1c81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.5-tuxcare.2 of dompurify. not_affected \u2014 DOMPurify 3.0.5 is not affected by CVE-2026-65912. The vulnerability requires the EXTRA_ELEMENT_HANDLING.attributeCheck feature, which allows ADD_ATTR to be specified as a predicate function that can bypass URI validation. Version 3.0.5 does not have this feature - it has no references to attributeCheck or EXTRA_ELEMENT_HANDLING, and only processes ADD_ATTR as an array via addToSet(). Without t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:75366d5c-34c1-56fd-94b5-6d1ab3e126b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:0e915aa2-39e1-5bef-8844-af38eda0b3b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:f87d48c5-8caf-5f95-b417-398928e8d6ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:5348addc-414e-5cd0-ab6e-ed86acfaebe3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:ac0678ec-b064-5ccc-b070-a6ad0262ed2d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.5-tuxcare.2 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:26748c53-fb84-5893-8dd3-8e7fe19e0235", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.5-tuxcare.2 of dompurify, and is fixed in 3.0.5-tuxcare.3." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2f6cc03d-f408-587e-af6a-bc6bf3774f3d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.5-tuxcare.2." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ], "bom-ref": "urn:uuid:b7061f88-fcbb-5b01-9c1b-da7ae0234901", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.5-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.2" } ] }