{
  "@id": "urn:uuid:a3b4fbcf-d08a-4c49-bf8f-4899855c7f08",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-16T14:25:00.578824+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2025-15599 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2025-15599"
      },
      "action_statement": "Vulnerability CVE-2025-15599 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2026-0540 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-0540"
      },
      "action_statement": "Vulnerability CVE-2026-0540 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2026-41238 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-41238"
      },
      "action_statement": "Vulnerability CVE-2026-41238 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2026-41239 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-41239"
      },
      "action_statement": "Vulnerability CVE-2026-41239 affects version 3.2.4 of dompurify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-16T14:25:00.578824+00:00",
      "status_notes": "Vulnerability CVE-2026-41240 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (per CVE PoC: `ADD_TAGS: function(tag) { return true; }`), but this feature does not exist in version 3.2.4. The target version only supports array-based ADD_TAGS via addToSet() (src/purify.ts:622). Function-based ADD_TAGS was introduced in October 2025 (commits 6c08b7d1, fa239f04),...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41240"
      },
      "impact_statement": "not_affected \u2014 Version 3.2.4 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (per CVE PoC: `ADD_TAGS: function(tag) { return true; }`), but this feature does not exist in version 3.2.4. The target version only supports array-based ADD_TAGS via addToSet() (src/purify.ts:622). Function-based ADD_TAGS was introduced in October 2025 (commits 6c08b7d1, fa239f04),..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-16T14:14:00.296685+00:00",
      "status_notes": "Vulnerability CVE-2026-49458 does not affect version 3.2.4 of dompurify. not_affected \u2014 DOMPurify 3.2.4 is NOT affected by CVE-2026-49458. While the vulnerable realm-bound `instanceof` checks exist in the codebase (in `_isClobbered`, template content checks, shadow root checks, and namespace validation), the attack mechanism requires foreign-realm DOM nodes to be accepted for IN_PLACE sanitization. Version 3.2.4's entry-point validation (`_isNode` at line 1452) uses realm-bound `i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49458"
      },
      "impact_statement": "not_affected \u2014 DOMPurify 3.2.4 is NOT affected by CVE-2026-49458. While the vulnerable realm-bound `instanceof` checks exist in the codebase (in `_isClobbered`, template content checks, shadow root checks, and namespace validation), the attack mechanism requires foreign-realm DOM nodes to be accepted for IN_PLACE sanitization. Version 3.2.4's entry-point validation (`_isNode` at line 1452) uses realm-bound `i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-49459 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-49459"
      },
      "action_statement": "Vulnerability CVE-2026-49459 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-49978 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-49978"
      },
      "action_statement": "Vulnerability CVE-2026-49978 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-65898 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65898"
      },
      "action_statement": "Vulnerability CVE-2026-65898 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-65899 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65899"
      },
      "action_statement": "Vulnerability CVE-2026-65899 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65900 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65900"
      },
      "action_statement": "Vulnerability CVE-2026-65900 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65901 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65901"
      },
      "action_statement": "Vulnerability CVE-2026-65901 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65902 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65902"
      },
      "action_statement": "Vulnerability CVE-2026-65902 affects version 3.2.4 of dompurify."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:29:00.177417+00:00",
      "status_notes": "Vulnerability CVE-2026-65903 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 does not have the vulnerable EXTRA_ELEMENT_HANDLING.tagCheck feature that enables the CVE-2026-65903 bypass. The ADD_TAGS configuration only accepts string arrays in 3.2.4, not functions. The feature allowing ADD_TAGS as a function (which populates EXTRA_ELEMENT_HANDLING.tagCheck) was introduced in version 3.3.1 via commit fa239f04. The vulnerable code pattern where tagCheck evalu...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-65903"
      },
      "impact_statement": "not_affected \u2014 Version 3.2.4 does not have the vulnerable EXTRA_ELEMENT_HANDLING.tagCheck feature that enables the CVE-2026-65903 bypass. The ADD_TAGS configuration only accepts string arrays in 3.2.4, not functions. The feature allowing ADD_TAGS as a function (which populates EXTRA_ELEMENT_HANDLING.tagCheck) was introduced in version 3.3.1 via commit fa239f04. The vulnerable code pattern where tagCheck evalu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-16T13:26:00.228327+00:00",
      "status_notes": "Vulnerability CVE-2026-65912 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 is NOT vulnerable to CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (via EXTRA_ELEMENT_HANDLING.attributeCheck) that allows predicate functions to bypass URI validation. This feature was introduced in upstream commit fa239f04 (\"Allow ADD_ATTR and ADD_TAGS to accept a function #1150\") and first appeared in version 3.3.1. Version 3.2.4 predates this f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-65912"
      },
      "impact_statement": "not_affected \u2014 Version 3.2.4 is NOT vulnerable to CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (via EXTRA_ELEMENT_HANDLING.attributeCheck) that allows predicate functions to bypass URI validation. This feature was introduced in upstream commit fa239f04 (\"Allow ADD_ATTR and ADD_TAGS to accept a function #1150\") and first appeared in version 3.3.1. Version 3.2.4 predates this f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:41:07.925643+00:00",
      "status_notes": "Vulnerability CVE-2026-65913 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65913"
      },
      "action_statement": "Vulnerability CVE-2026-65913 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:40:27.789940+00:00",
      "status_notes": "Vulnerability CVE-2026-65914 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-65914"
      },
      "action_statement": "Vulnerability CVE-2026-65914 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-11T21:33:00.129558+00:00",
      "status_notes": "Vulnerability CVE-2026-66010 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "CVE-2026-66010"
      },
      "action_statement": "Vulnerability CVE-2026-66010 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:40:27.789940+00:00",
      "status_notes": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "GHSA-55q2-fjhq-7xh7"
      },
      "action_statement": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.4 of dompurify."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/dompurify@3.2.4",
          "identifiers": {
            "purl": "pkg:npm/dompurify@3.2.4"
          }
        }
      ],
      "timestamp": "2026-10-11T21:33:00.129558+00:00",
      "status_notes": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.2.4 of dompurify.",
      "vulnerability": {
        "name": "GHSA-6688-9rhm-gjv2"
      },
      "action_statement": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.2.4 of dompurify."
    }
  ]
}