{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2da1eb87-f5e7-57f8-973c-25cf0ddb799b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6-tuxcare.2", "version": "3.0.6-tuxcare.2", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "version": "3.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:34207f77-fe35-5b43-8880-f90e36b6004c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:bd5dfb85-73ef-5faf-adc3-dd479ef7cdd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.4." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:cb3c1f6a-030d-543c-af48-97e39bf946d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7ec187c7-6123-5ed9-b555-c53590a47cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7da3ebd7-496a-5cfb-9169-c9a0d38a13ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:08e1e9cb-018f-5c7a-bddf-4e2527c1b7db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6-tuxcare.2 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:09eb5ec7-ed6e-5e78-ba95-4a785260a3c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:b4004536-af59-560c-8a2d-6ec6ef3f5f1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:bc79076d-9df9-54e4-88c8-868d2494ac3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:88bbd0f5-e273-5ae1-8f88-44c06ff6caac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2f9cb333-a6ef-5c7b-bd67-b6668d2fe11b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7ccffbc7-369c-57f5-897b-a043e03ef064", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:0d0c29e0-4a70-53af-ace5-42d26522312b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:bc463f17-8f10-59ff-8a56-6b9d1877899e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:213f5745-67fe-5b19-817e-b8488ca83ab3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6-tuxcare.2 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:6c49aa66-cae9-5712-9680-f9ef01de3020", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6-tuxcare.2 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:e4a957c1-6abf-504a-8683-4fb6286ab683", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:9cb98537-a13a-5fbe-a8c9-8e4963987123", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:23a8e8da-e799-5058-b2f0-d21aab8caacb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:33c9797d-d9aa-5b07-8f45-0959156c2305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:0389d91a-1ec2-501d-9607-d93eb34ffb4e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7fbc3d34-f33b-5fe0-a810-b48123615d9c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.6-tuxcare.2 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:4c0820dd-19d1-53a3-a529-ac3320bab2d3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.6-tuxcare.2 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:1022abdc-62a7-5af0-abe1-06d8950ca46e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6-tuxcare.2." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ], "bom-ref": "urn:uuid:73339b98-36c5-5105-aac5-f66691b76296", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.6-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.2" } ] }