{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ae89a733-a59a-523d-b4f7-bc726976ebfc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6-tuxcare.5", "version": "3.0.6-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "version": "3.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:5ecd5072-86ed-5182-ab23-2af20a8b0df8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:db02c99e-0999-592c-baf6-737782c62c70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:cba87757-d8cb-5f3d-9901-07f10ef207d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:7554ae8a-d6d8-584b-9399-0194ca5e3f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:9af778d0-eb04-5536-92d9-a8815c679ddd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:a46e73eb-74c6-5452-b26e-b6cc48be4f9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:f0577384-f587-59bc-aa42-ad962e67f314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:eefa70e4-10b3-551c-abff-7ad6de15fea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:591b0c46-4f1d-54ae-9b8c-2eaa220e894b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:2c786e2f-64e7-58fc-b4c2-bfee86215f94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:b38c35e1-75c6-59d5-ba1d-4347e6c7a09e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:ad6e96ca-cf81-59dc-b1b3-df1de0160992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:a38c0238-cde9-51c9-9f22-a20fb7222c22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:657f9bf9-4527-5bee-9208-c67dc8515ad3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:e433368d-55a8-554e-9dd7-bc0f3f01ef61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6-tuxcare.5 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:11cd338d-c636-5848-8f41-c9082df5609e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:f85152dd-cf89-5a6e-a47b-31fbfe3ad65d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:f3960234-ad27-5316-a5d2-151bcc2bb9b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:85db8651-bc66-586f-8c58-76e3cd4a4a2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:bcebc184-72fb-5b1f-b3d6-9cb3c68398ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:b19cceef-789d-582a-9f3e-9b50f56cb9ed", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:3b0ffcc9-d3b0-5ce8-b472-548ceb39a072", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:67702cb5-4e79-5c81-9232-21e3e22bb80d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.6-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:6cd7f770-e8e0-55da-a92c-8bd68402e868", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6-tuxcare.5." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ], "bom-ref": "urn:uuid:a91b45d2-8a05-5a6a-9f48-6c215c362b50", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.6-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.5" } ] }