{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0f66d039-7e45-58ad-84f8-327f65f420a9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6", "version": "3.0.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:c310deb5-2b7f-5ba8-8b47-02bb254cc6d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.6 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:8a736678-bca1-5f95-9deb-3e55c80aa663", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.4." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:e6ed5062-5fe9-52a3-b151-674486d32d59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:4e88eb91-4caa-5223-8fc6-739a67075e5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:b43fd6d0-fad4-54e1-b82a-b12023fd1d7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:9334976d-b213-5211-872e-5bc55cbd44a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:8a6b66f4-8d4b-5e09-b99c-d85a544a0995", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:f51eea27-f961-5e88-99c7-60628ba040c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:21d411fc-4064-5417-aa88-7155c2640dec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:eeea7f01-5a24-59f7-90bc-c23321d4ef88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:0ca56902-f3c7-5f2b-8c85-361efdbc68ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:181f3c1a-3512-5a73-a14f-04aff5057072", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:a38daefd-cdd7-5434-af20-2c4de1adb868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:4b244264-1f6a-5ccd-bfab-7ead468c4fd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.6 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:e5d54558-72bd-5c9a-a8b2-3a8e704ad8c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:840be183-20b5-586d-b9d6-a132c9c26bd3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:5965b7d6-71d4-56b5-9855-dfb4a581cb83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:3a98f114-22ae-57c6-8a9b-cd692126c257", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:23064698-2f6c-54d2-b60e-bab5a3b6a880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.2." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:24d47974-6cec-5398-83b5-83ce928b5706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:3bc5b8d3-5805-57a5-9ddf-1a52412cc20e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:e70b7263-6427-5710-a84b-ab2c0d433a1d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.1." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:4cadbbca-13e6-56d5-8619-f13f2fcc36af", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.6 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:9da005d7-8dcb-554b-9f02-e746a2607244", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6" } ], "bom-ref": "urn:uuid:cfaf25ae-0864-5565-87ed-bb8b74e69cc1", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6" } ] }