{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c1c78e8-040b-5b90-a9d5-fca7085fe8c0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.1.6-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/dompurify@3.1.6-tuxcare.10", "version": "3.1.6-tuxcare.10", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.1.6", "type": "library", "version": "3.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:04ed0a10-1f00-59a7-86c3-89a7beb94267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:887b8bc1-775a-5fa4-b76c-9152bffbb26f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:1e1b9b9f-9c9b-57d4-ad3f-cf4c1eb4702c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:951ecfa4-517b-5faa-bea0-1c16bc23c5f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:c695e6a8-d3f4-522f-8388-0ebcfc7009b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:2e639776-0b57-5f9a-ab9d-1632cbc815f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:aac85d7f-e455-557f-98da-7851cf8f0b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:c1a6e0b5-18a3-5a40-856b-1e67e0c1a585", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:7c65e732-0447-521b-96a0-81e1e35d156e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:2831fb1f-179c-5aa2-b8b8-f1a1cadebeea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:5f57f32f-cc79-5a10-94e4-7e7e11ee715a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:b0eb40c4-276f-59c7-b420-17ffc5f4dc4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:ed281fe7-d269-5342-8bd9-2ff6b31b9fc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65901 does not affect version 3.1.6-tuxcare.10 of dompurify. not_affected \u2014 Version 3.1.6 is not affected by CVE-2026-65901. The target contains a defensive mechanism that uses a realm-safe cached prototype getter (getNodeName) to validate element types, which bypasses attacker-controlled own properties set via Object.defineProperty. The CVE explicitly targets version 3.4.6, which is newer than the target version 3.1.6.", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:20700a2e-1377-51be-8e5c-d9de15d91f8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:c0f24154-8f60-5aa2-893f-956015ff4de3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.1.6-tuxcare.10 of dompurify. not_affected \u2014 Target version 3.1.6-tuxcare.5 does not contain the vulnerable code pattern described in CVE-2026-65903. The CVE describes a short-circuit evaluation issue in v3.3.3 where ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) can bypass FORBID_TAGS. In v3.1.6, the equivalent logic (CUSTOM_ELEMENT_HANDLING.tagNameCheck) includes an explicit guard at line 1538 that checks !FORBID_TAGS[tagN...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:c2923cef-2c24-5a7c-ba10-1e20ccfa7fc0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.1.6-tuxcare.10 of dompurify. not_affected \u2014 DOMPurify version 3.1.6 is not affected by CVE-2026-65912. The vulnerability requires predicate-based attribute allowlisting features (ADD_ATTR as a predicate function or EXTRA_ELEMENT_HANDLING.attributeCheck) that do not exist in this version. Version 3.1.6 predates these features entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:0b391fe8-65ee-504b-8cb5-6a30876b19b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:a261a2ee-a657-5fee-a362-bbaa430fe8d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65914 does not affect version 3.1.6-tuxcare.10 of dompurify. not_affected \u2014 DOMPurify 3.1.6-tuxcare.5 is not affected by CVE-2026-65914. The target version contains a runtime defense mechanism (SAFE_FOR_XML, enabled by default) that removes attributes containing closing tags for special parsing-context elements (xmp, script, iframe, noembed, noframes, noscript). This defense prevents the mutation-XSS attack described in the CVE when DOMPurify is used with default confi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:24fce6a3-cee2-5914-92a0-09782099290e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:f5e80d5c-9a5f-528a-a249-c41efc6931dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:0ab7ad3d-a201-5bb2-bb2c-a746e3d025d5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:1eee2779-04ec-5d27-8767-1bf5c2ca822a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:fa5a84b5-236f-5fc2-be47-8fe6979b6fdb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:ffe6e675-9ea9-543f-8bd8-24c25e7a3030", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:040aff93-3c1e-564b-9484-41a2af9d3935", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:63432e1a-187c-5ef6-8ff9-b54941cad1f8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:04ff4bf0-841b-55e9-a3c6-65c098eb77f1", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:c464a0ee-0db2-534c-9712-0080d46db366", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:f78c704c-ff3a-5dc9-975b-6ff5c78b525e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:e2d1e136-26a8-537f-9352-7ade34518346", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:78b7a17c-5404-5aaa-98f4-02ddeb07825e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:451fe953-99a0-566f-9be5-a4e8aed2a8db", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.1.6-tuxcare.10." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:0ad0da8a-d992-5e03-be65-52eece45eb31", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:27886455-8ec8-56c9-b888-0f6f23281b54", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.1.6-tuxcare.10 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ], "bom-ref": "urn:uuid:df816f80-4205-5124-85cb-f89d98c05926", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.1.6-tuxcare.10 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.10" } ] }