{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aed94635-85b4-5215-b6d5-be98825624dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.5", "version": "3.2.3-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3", "type": "library", "version": "3.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:391ae1c7-c7d4-54e1-b387-f0299d0710af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:474e454c-a816-51fb-a150-cdb8cca38a99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:686e773a-6d9b-5f83-86b9-4cf43b52d11d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:007f72cd-4c84-5271-8758-f22de261f20b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:30daeb1f-85b8-5341-95e0-37c60f3000bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:e57e278d-9b4d-55ec-a836-928c68e650b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:f02a32f1-49ca-5e17-82e4-0c8c45ccf502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:64ef3b28-e7a9-598d-8491-6ce0ded7ffc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:c9862077-95a4-5aad-bde0-0d47179f5567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:79c525ee-6c67-5eb8-9e33-8be613fdb3f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:87c26b71-b400-5cfd-b0b2-32907cc6f66c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:9a104f66-6963-5d5b-8dcf-d3e5a2bdae3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:57e97733-924f-57bd-9513-ca9c975764ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:1afac15b-2d50-5c99-b6dd-a3a5e5557779", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:33ebbf2c-3fcc-56de-8bf7-d8a83b7c9e64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.5 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:ba03b1b9-4876-57c9-8e90-a8d27b4cca26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:022be8b6-517e-5abd-bdea-bf2bac127aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:d078336d-6e40-52e2-a767-c0557620076f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:61f53388-730f-566a-b299-6045acd298d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:45be100b-6f52-5a38-9f96-b5afb2f2b0c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:b2be9641-6d52-58f2-aa54-2eb893fd88ad", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:50a9b9bd-cd37-5186-9176-a24c231b7395", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:9917b813-6d79-5847-b0fc-1d95b7efd828", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:ccc49aa5-818e-5346-a8f7-bfcdef4b2e3a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:2797892a-5c72-5d07-8a6f-258b25b326b8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:5fb9de4a-53b8-5f3e-9cb5-d7e53c7ac84e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.2.3-tuxcare.5 of dompurify, and is fixed in 3.2.3-tuxcare.6." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:d9f800da-71cc-5fd0-8e53-1f9a37fc7065", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:dbe44993-a208-5f2a-990c-61ed31b5d32f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:3d240201-f9a5-5d7c-996c-1412e74ca540", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:1b51b17e-3636-5f85-8666-7713da85f1f3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:3b3c2ef7-f667-5f20-a639-de43cb3877cf", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:6236300c-f9fa-5788-b758-c9545e163604", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.3-tuxcare.5." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:0ef9a790-ec01-548a-b2c2-f6318f5b433d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:3fa42a62-607d-5e97-8bba-9380624766c4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:a76589af-f171-5c22-9e07-8cf1e0b061be", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.5" } ] }