{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:779d6689-cc0f-54b2-acc5-55543612141b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.5-tuxcare.3", "version": "3.0.5-tuxcare.3", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5", "type": "library", "version": "3.0.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:1fa300c4-1c0e-56bf-97f1-5186635e6429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:977f8a9e-325b-5b10-89ec-1fe408beff97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:f2c3ecc1-3351-5d04-89b6-da9777ee63b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:24c130de-63c6-5892-8daa-c8938163d958", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:43f255f4-9416-5a60-a26d-8f768a0467b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:c810cc4c-7959-5cd8-9789-aad55825c070", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.5-tuxcare.3 of dompurify. not_affected \u2014 CVE-2026-41240 affects DOMPurify versions 3.3.0 and later that support function-based ADD_TAGS configuration. Target version 3.0.5 does not have this feature (introduced in 3.3.0, October 2025). The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck mechanism to bypass FORBID_TAGS checks via short-circuit evaluation - this mechanism is entirely absent from 3.0.5. Version 3.0.5 uses only arr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:85d968e2-3d54-5b47-bca6-99dcafaaeccd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:f112ee4f-e0e3-5add-bf40-470744e489c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:01b1b9e9-619e-526a-a35a-8d6b43a2d169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:90a93125-92ed-53bd-92e8-79087810df36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:5daa9b8c-6416-5822-a088-c8fc8ade2398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:5e360a70-9656-5b72-80ea-b13b6c21e94b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:a8f5ab05-7bd7-561d-ac7a-390c12b3d967", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:ab32b482-a9c1-5f3d-bd28-f5aca1cda0e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:5b8914d4-69f2-5d82-9b3c-19abb1bef9fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.5-tuxcare.3 of dompurify. not_affected \u2014 DOMPurify v3.0.5 is NOT affected by CVE-2026-65903. The vulnerability is a regression introduced between v3.0.5 and v3.3.3. In v3.3.3, the condition `!(tagCheck(tagName)) && (!ALLOWED_TAGS || FORBID_TAGS)` allows tagCheck to short-circuit the FORBID_TAGS check. Version 3.0.5 uses a different architecture with an explicit guard `!FORBID_TAGS[tagName]` at line 1019 that prevents forbidden tags fr...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:aefc82de-f2b7-5fc1-8bdd-11ca06b84c9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.5-tuxcare.3 of dompurify. not_affected \u2014 DOMPurify 3.0.5 is not affected by CVE-2026-65912. The vulnerability requires the EXTRA_ELEMENT_HANDLING.attributeCheck feature, which allows ADD_ATTR to be specified as a predicate function that can bypass URI validation. Version 3.0.5 does not have this feature - it has no references to attributeCheck or EXTRA_ELEMENT_HANDLING, and only processes ADD_ATTR as an array via addToSet(). Without t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:0e8e653b-5dab-59b6-8c7d-d053798a9e95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:e1a62613-da45-536f-b8e6-2e24c1da537f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:0681b1db-4e14-5b8f-b2df-24318e26874b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:c10296dd-4ab8-533a-ae47-9073ee287f96", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:07655f1a-bd51-5d4d-a6c0-4f92ace5ad46", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:3430faa9-4c06-5618-af2a-8b5b462a411d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.5-tuxcare.3 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:3c4e4e23-5fd3-5933-a289-797ec32977d4", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.5-tuxcare.3." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ], "bom-ref": "urn:uuid:fb038103-175f-5ee0-8150-c6bea85a1c7b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.5-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.3" } ] }