{
  "@id": "urn:uuid:eebbef39-8ff1-461e-94f1-b29429facaff",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-16T14:25:00.578824+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2024-45801 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2024-45801"
      },
      "action_statement": "Vulnerability CVE-2024-45801 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2024-47875 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2024-47875"
      },
      "action_statement": "Vulnerability CVE-2024-47875 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2025-26791 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2025-26791"
      },
      "action_statement": "Vulnerability CVE-2025-26791 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-41238 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-41238"
      },
      "action_statement": "Vulnerability CVE-2026-41238 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-41239 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-41239"
      },
      "action_statement": "Vulnerability CVE-2026-41239 affects version 3.0.4 of dompurify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T14:25:00.578824+00:00",
      "status_notes": "Vulnerability CVE-2026-41240 does not affect version 3.0.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41240"
      },
      "impact_statement": "not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-49458 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-49458"
      },
      "action_statement": "Vulnerability CVE-2026-49458 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-49459 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-49459"
      },
      "action_statement": "Vulnerability CVE-2026-49459 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-49978 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-49978"
      },
      "action_statement": "Vulnerability CVE-2026-49978 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-65898 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65898"
      },
      "action_statement": "Vulnerability CVE-2026-65898 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65899 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65899"
      },
      "action_statement": "Vulnerability CVE-2026-65899 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65900 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65900"
      },
      "action_statement": "Vulnerability CVE-2026-65900 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65901 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65901"
      },
      "action_statement": "Vulnerability CVE-2026-65901 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65902 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65902"
      },
      "action_statement": "Vulnerability CVE-2026-65902 affects version 3.0.4 of dompurify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:31:00.155648+00:00",
      "status_notes": "Vulnerability CVE-2026-65903 does not affect version 3.0.4 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-65903"
      },
      "impact_statement": "not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:28:00.173627+00:00",
      "status_notes": "Vulnerability CVE-2026-65912 does not affect version 3.0.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65912"
      },
      "impact_statement": "not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65913 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65913"
      },
      "action_statement": "Vulnerability CVE-2026-65913 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65914 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65914"
      },
      "action_statement": "Vulnerability CVE-2026-65914 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-02T22:54:42.937081+00:00",
      "status_notes": "Vulnerability CVE-2026-66010 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-66010"
      },
      "action_statement": "Vulnerability CVE-2026-66010 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:40:27.789940+00:00",
      "status_notes": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4 of dompurify.",
      "vulnerability": {
        "name": "GHSA-55q2-fjhq-7xh7"
      },
      "action_statement": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.0.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.0.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:03:00.181592+00:00",
      "status_notes": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-6688-9rhm-gjv2"
      },
      "action_statement": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.4 of dompurify, and is fixed in 3.0.4-tuxcare.1."
    }
  ]
}