{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9dae35c2-304d-502e-a30f-bbaf1607d95a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.6", "version": "3.2.3-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3", "type": "library", "version": "3.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a37d90f8-7a5b-5e50-9f27-bedff01b4f3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:7a95eee3-0378-5006-9c4c-34655e5b9df8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:99e887e0-6b96-5378-b7f4-186427b4f9bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:f8bead8e-a2f6-50cf-b059-edaaa7f86726", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:9d900cc2-d8e1-5ff5-9f32-7ae0f3adaf09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4eb0bd2e-2d8b-55b9-8b21-b3a37cc08bab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:804dde4d-ff72-5bb5-a212-7075502a9cb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a140c5b2-d388-5a29-905d-a43c5f6aecc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:f855ed6d-1249-58f5-9bf0-5b118e67e9c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a18c3c1a-9c96-58d3-be51-d42d997811cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:540b6f64-d98b-503d-b370-5a3b99065493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e49f5dda-b171-50fb-b83f-1df46318e97e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:8d3297b7-e952-5807-bcb8-c25a89e8c17a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:f08d2365-54bb-5ccb-a7c2-30b0afaa35cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d7210ad2-f279-5d34-8291-6fbaaa0dc06b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.6 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:3c0b6e45-27a5-5506-a148-64e2af4dee20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.6 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:8722219a-28d0-5b23-b684-c6b40c76b9a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:8f532b30-8b8d-558d-be2c-0f28453372a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:3851bf72-8113-5411-892f-12e3013829db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:84f12f7f-71c7-5f99-8a60-81df9942bbd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:809b273e-03da-5ac7-a492-164633a7c7d6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:3880610f-ce1a-5e99-adca-a310c7631737", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:c7abc63f-72ca-57b0-a7c0-53d98b034226", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a4fa5da0-b69e-562f-ab29-fe8abd11cd1d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d43f039c-56df-55c8-ab8c-8a1ce792460e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:b67ca026-ad42-59fd-ac7f-497d192d1637", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:8164e295-a99a-5889-a075-a51afeed58b6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:c8b58b5b-d85e-53f3-b649-b2e67860e030", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:eb36a713-5a69-5fa2-9280-e3300d47c82c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ffd9b78c-8ca6-5b69-b6f4-2ea05a18a319", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:8c60a78d-b1d7-5583-954a-00cac9d75036", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:7f8fb24a-9f5b-5216-9357-06761aaca8fe", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.3-tuxcare.6." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:7265cc1b-22a6-5ce9-b126-563ae523c978", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4f7015b3-42cd-5ed4-86da-42046b5c7558", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ], "bom-ref": "urn:uuid:1d0f4c08-7813-51b5-92f0-d03c2b4bc6f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.6" } ] }