{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dc743e73-b245-5df7-a1b0-ee4b50c9b87c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.1.6-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/dompurify@3.1.6-tuxcare.9", "version": "3.1.6-tuxcare.9", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.1.6", "type": "library", "version": "3.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:f0c0d911-611d-54bc-90bf-7cc014bc2a59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:7843cd4b-1858-5e43-9fe7-e280eb48a8b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:b9cd51ce-42a1-5b14-8cd9-bf507da38ab1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:d92043c4-f7f7-5f87-8ffd-4f8e808fd8a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:51621c22-a5f9-5fb2-8e9d-64793155ab30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:5868b0ea-4f51-5992-9bf9-b3e04819ce98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:d5a86892-e0ee-5416-8027-0938ffa850e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:f0a15344-45c0-5520-85d7-fcd2aa1736cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:400538b4-e8f3-5e84-809f-51669a07e093", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:7c5e0a78-c7e1-53de-9ed9-654261090fc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:6f2f748e-c297-5aa8-b941-5bd5bab2d557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:dd2494e0-10af-5b5a-a75f-8e4de2084a0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:5a25652e-af5d-5cf5-91cf-52b00a873b7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65901 does not affect version 3.1.6-tuxcare.9 of dompurify. not_affected \u2014 Version 3.1.6 is not affected by CVE-2026-65901. The target contains a defensive mechanism that uses a realm-safe cached prototype getter (getNodeName) to validate element types, which bypasses attacker-controlled own properties set via Object.defineProperty. The CVE explicitly targets version 3.4.6, which is newer than the target version 3.1.6.", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:7ce0c9ee-0895-5a87-be36-ab6ee33f3d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:e4bffedc-c279-553d-b673-c2aa8dcfb477", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.1.6-tuxcare.9 of dompurify. not_affected \u2014 Target version 3.1.6-tuxcare.5 does not contain the vulnerable code pattern described in CVE-2026-65903. The CVE describes a short-circuit evaluation issue in v3.3.3 where ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) can bypass FORBID_TAGS. In v3.1.6, the equivalent logic (CUSTOM_ELEMENT_HANDLING.tagNameCheck) includes an explicit guard at line 1538 that checks !FORBID_TAGS[tagN...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:c5da4cc9-cc0d-5928-9513-995a553a3af7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.1.6-tuxcare.9 of dompurify. not_affected \u2014 DOMPurify version 3.1.6 is not affected by CVE-2026-65912. The vulnerability requires predicate-based attribute allowlisting features (ADD_ATTR as a predicate function or EXTRA_ELEMENT_HANDLING.attributeCheck) that do not exist in this version. Version 3.1.6 predates these features entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:3240eb98-2c84-5f45-ab74-3c4e2e9e675f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:9d480a66-f0e5-5883-8327-68b2006d529c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65914 does not affect version 3.1.6-tuxcare.9 of dompurify. not_affected \u2014 DOMPurify 3.1.6-tuxcare.5 is not affected by CVE-2026-65914. The target version contains a runtime defense mechanism (SAFE_FOR_XML, enabled by default) that removes attributes containing closing tags for special parsing-context elements (xmp, script, iframe, noembed, noframes, noscript). This defense prevents the mutation-XSS attack described in the CVE when DOMPurify is used with default confi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:d23bc1d5-85e0-5c2f-948c-c18ef99115d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:0a837f9e-748b-537a-b5ab-9dc4ff284815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:e7cf4332-a240-5ad1-9f8e-84a22ae01165", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:17adbb1b-4977-5377-a88d-ec725eb853be", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:31459ef7-8b05-54d3-8d32-42a2aecc9fad", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:eb307bc1-2e6a-586e-9b8d-06ccf0c0fa3f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:4a00a88c-c8aa-533f-b07b-28ebf7fa0e20", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:7077e12e-43ce-52de-a01f-4c0bf183c363", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.1.6-tuxcare.9 of dompurify, and is fixed in 3.1.6-tuxcare.10." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:fff0984e-eed7-51b5-ab33-c037fa4d6774", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:3357c270-8306-5c08-9fb7-50d85626de70", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:11e966ed-e460-5991-8bed-5cb6b7402571", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:4e5514f7-5e1c-5a2e-b21b-08d218b32d13", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:241cd9f0-b60c-5517-9d65-de291a6c29d0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:24aa08ac-9919-53df-998a-43c09e96e9be", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.1.6-tuxcare.9." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:6ea6019f-9466-5305-a1fd-72b9a9dacfdb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:78675f9b-a29a-5513-8319-245d883b1feb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.1.6-tuxcare.9 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ], "bom-ref": "urn:uuid:7de46a0c-364e-5979-bb77-0ccbf290c812", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.1.6-tuxcare.9 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.9" } ] }