{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e937c4d-5748-5f15-9458-f9a09210a0d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.3", "version": "3.0.3-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e150e42f-d534-5e7b-ad13-195864719ac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:68783f24-6a83-5c76-be4d-dde0afdecea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:19974457-66e8-5dea-8b9a-0aa48f08ef35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3494f6b6-b7cb-5bf7-8415-dd28865a47ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:1155e141-7043-57e1-a581-f9155f40baed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:dddf0753-4304-55c4-8d37-a12b3039afba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:1faa19b9-72b8-51bf-baf5-27c0dd3fc170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b308188f-c13c-56b1-ae22-f207226e79b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:0d6a8bf6-6faa-53ed-8c58-9e5f1312d6cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:79fee4d0-bc40-55d7-9d6d-dbe2cf1881b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:ce7200ea-ed07-59f3-ab4a-d831b25d0d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d65152aa-699d-5cdf-a70b-7070022f94e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:fdb95f2b-6c43-5099-8c66-eb895258c5e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.3 of dompurify, and is fixed in 3.0.3-tuxcare.5." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3cb6c40d-a31f-555f-9205-f79f65c5e2f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:98c73861-73b1-5bc6-a08a-b2f3a662e10a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:4ca1d7bd-ab68-5dda-9a10-97503368a571", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.3 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:8c4059e6-c278-599c-a3dd-ce1dd2b82abc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.0.3-tuxcare.3 of dompurify, and is fixed in 3.0.3-tuxcare.4." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3a8d6dd2-d34b-5cb3-b583-de7e533b5d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d0eb8ced-5119-5fe3-b6b4-1895158b825f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6abdeea2-f8d0-5f5e-8e35-918d450f7da3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:8dd87754-f441-573e-a072-079ebde6689c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.3 of dompurify, and is fixed in 3.0.3-tuxcare.5." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7887e177-9bda-5913-8ecd-0c394a59501b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:de1d350e-a19f-51f7-8e49-786d57da00be", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:829cd7e6-eafd-5afe-baeb-49f34be15d4e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:71f16e3c-3d48-5296-828f-5417d18c779a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e6c70971-1af2-5e5d-91fd-aa03d2f291f9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:eff82111-15fb-57d4-be0f-1b0b0e8c61af", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:582f01c3-4302-58f7-9647-0ee64940d310", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7f80760a-a5f6-5f19-a5f8-9d2bf6db8ca6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f668e33c-2ddd-53ef-b3d9-3dc83331422e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a4b3ba3a-58cd-585c-970f-fb9b0479ea1f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.3 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ], "bom-ref": "urn:uuid:67954731-9261-56ca-922b-40a254131212", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.3" } ] }