{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e6c00f00-3c70-55b7-8f38-f3f688182650",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "dompurify",
      "purl": "pkg:npm/dompurify@3.2.7-tuxcare.5",
      "type": "library",
      "bom-ref": "pkg:npm/dompurify@3.2.7-tuxcare.5",
      "version": "3.2.7-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "dompurify",
            "purl": "pkg:npm/dompurify@3.2.7",
            "type": "library",
            "version": "3.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-0540",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:3b204300-0b51-5140-89b4-f98c9276a09d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-41238",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a60f3a65-47eb-5790-b5bb-05b245d0f402",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-41239",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:5685455d-a58a-56f6-b28f-eb3c9bb9d30a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-41240",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a3ce8415-3bb8-58ea-83f2-732c0c52c6bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41240 does not affect version 3.2.7-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires the EXTRA_ELEMENT_HANDLING.tagCheck feature and function-based ADD_TAGS configuration, which were introduced in version 3.3.0. Version 3.2.7 only supports array-based ADD_TAGS and lacks the EXTRA_ELEMENT_HANDLING mechanism entirely, making the attack vector described in the CVE impossible to trigger.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-49458",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:954f62ff-dcde-5cf9-a0a3-4058135e8f36",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-49459",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e049223d-c054-5e74-9986-7453e7e53d06",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-49978",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:89b0f18e-bddd-5d7c-ba08-7fcc0869145c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65898",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f319ce54-60e2-5be9-959f-34dd0bd1ca65",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65899",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d8ea3266-6d29-5867-a271-edc28ecb491c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65900",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:b4b70c2c-dc70-5ec5-8c80-c024741b1204",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65901",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:3429d2cd-6b1e-5478-b88b-15819d6d5ffd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65902",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:dd1de347-13e9-5e73-b227-faaba3630bed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65903",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:804b35cf-cbb0-5e05-a441-f4852878c2bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.7-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.2.7 is NOT affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck, a feature that allows ADD_TAGS to be used as a function, which was introduced in later versions (v3.3.3+). Version 3.2.7 only supports ADD_TAGS as a string array and does not have the EXTRA_ELEMENT_HANDLING mechanism. The existing CUSTOM_ELEMENT_HANDLING in 3.2.7 correctly prioritizes ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-65912",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:7c107259-7d27-5333-a4ec-737a81f49f79",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.7-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is not affected by CVE-2026-65912. The vulnerability requires ADD_ATTR to be provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck, which bypasses URI validation when returning true. This function-based ADD_ATTR feature was introduced in version 3.3.0 (PR #1150) AFTER the 3.2.7 release. The target version only supports ADD_ATTR as a string array (typ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-65913",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:134d5b66-d044-552f-8246-3ea26bc9bf8f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65914",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f5cf6cb8-0371-5e14-a2e6-0616406abd88",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-66010",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:59f050b4-e97c-5e77-bead-5d90f1698047",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-75838",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a87e15f8-a207-597d-9099-692db5401ad7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "GHSA-55q2-fjhq-7xh7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:bcbcb03f-3dfa-5cab-b57a-42ce5086a62a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "GHSA-6688-9rhm-gjv2",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f43b455a-1a89-5910-8add-787ceb6d6018",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "GHSA-c2j3-45gr-mqc4",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:049ab8c0-3383-5fa1-9d74-7292e4721c8d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.7-tuxcare.5 of dompurify."
      }
    },
    {
      "id": "GHSA-c6gr-qvv4-5v3f",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f43cab07-d25c-503b-a024-d73e18af430b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.2.7-tuxcare.5 of dompurify, and is fixed in 3.2.7-tuxcare.6."
      }
    },
    {
      "id": "GHSA-jxrp-r7gx-q4j8",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:dc078980-2203-5633-be6f-8501bc4504e3",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.7-tuxcare.5."
      }
    },
    {
      "id": "GHSA-mrv2-3pqr-j5jr",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:2eea15ed-e441-587d-9394-a8b8d76602b4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.7-tuxcare.5 of dompurify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5"
    }
  ]
}