{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3804eaae-b99a-5b4c-9ee9-be51817480ee", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.2", "version": "3.0.3-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:65b4ec67-6075-5cb1-a427-61512221a65b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:29a69b3c-ad35-5b95-afbe-e8336fe45fb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d2f5be09-7762-54ec-8598-c68cec916eb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a13adbfd-3f1b-5905-b25c-d8410fc74b69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:914550a5-d1d1-50c5-b058-6bfe7418bb3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:58c6af4b-6269-50e3-8b8b-0d2b82acb6b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:6f474be7-770d-5302-8ed4-e11adc91fc97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:eddca761-e45b-5bfe-82d9-e517ec2dce1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:21d643b1-7dea-5cd8-b2da-5c3e7fe9df10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c928b1e7-6d67-5f8b-a3ec-f9cbff034597", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c6ba948c-8dad-523c-adf7-334cd5f4c625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:83c0ed7b-ea40-5dd4-a436-01019f67e0b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:45406328-f3b3-5479-8ee5-3463f45e8c70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.2 of dompurify, and is fixed in 3.0.3-tuxcare.5." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a999b0af-a776-569c-9039-5e77f869c1d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:b049c788-7401-532d-9604-1a99107ce817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0dc46d7e-195f-51b9-8b06-fc0934c8a7a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.2 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a61330fe-e54e-5047-9428-fb18f6bae3bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.0.3-tuxcare.2 of dompurify, and is fixed in 3.0.3-tuxcare.4." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5dc45958-ddb5-5e02-aff9-59aa937963e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:7472fce4-06fa-5992-9496-8b7b2819bb5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f5c3c246-04ee-588b-ad37-f0ca5c4b6d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9629e027-3233-54b3-b583-348f6751d2a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.2 of dompurify, and is fixed in 3.0.3-tuxcare.5." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:db04c2ea-df0b-55bb-96b4-bf610278a9fe", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f5c7b50f-54a3-515c-8783-df837311e622", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f569536e-6b9b-52c5-8b71-d8f5647bc86b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:1e16cf2c-d5de-5d2d-b056-52305e40321b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.0.3-tuxcare.2 of dompurify, and is fixed in 3.0.3-tuxcare.3." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:10ac7142-d539-552f-89f8-8d4003d38d0e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e9637af3-ac00-5c97-a3ac-82e036d91412", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9316e845-f644-558b-a115-49c5d5e28093", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d0cb0402-21f8-5967-b792-50546db95b54", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:dacbe4a9-2051-54ec-b868-14c41e469418", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:32bccfea-e7e4-5828-8036-ebf0dfccb168", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.2 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ], "bom-ref": "urn:uuid:bf3c6b6e-3389-5b39-8621-dfcd1f2055db", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.2" } ] }