{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5974f7f2-3b7d-5b11-9282-ed34e4b3972d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.4", "version": "3.2.3-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c2153809-7f3a-54bb-a26d-9d9e589614a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:22b320ce-90e4-587b-acc3-6c072f1427f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:8939b863-0ad2-588a-a817-8454e2274b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:426bb412-6f57-5680-b2c6-025660947141", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:a2461dff-48eb-51f8-acf0-94d6c858b35d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c3103fb5-6b9c-58e2-86e3-3cfc4c70377d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e7751fb6-150d-5424-95a7-c91eb0d83b22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:d05b4d4a-0a00-5dac-8585-ee949162cc76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:26bc9e1f-aec8-57da-b3c6-f0a1f1227b8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:5b4fbcb9-e2e0-5a7a-8378-8a7a3d46f516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:6f2bb7f9-ae97-5a60-a7f0-d1431c610be9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:ff8d6417-151a-516f-9188-87dbbdd34517", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:54b6df6b-650e-5df8-8832-72b4a0438fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:19f0691b-68d9-5832-b9fe-f14f0984edc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e79a7b0d-ed75-549f-80b3-daef8cccd9b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.4 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:cd64b00d-e52e-5f3c-83f9-ed65e43501e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.4 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:b1fa398d-d402-5958-8e55-98741d671065", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:cfbe24bc-1a31-543a-9f48-184ca24630c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:ba02dd81-5312-5d24-8a9b-149781f92034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:7f6450e1-42d0-51e7-a732-f7518e148911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2b1b1e41-ba0e-57e9-a90e-9c717df55c6d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:ead82526-9746-5627-bbbe-1992ec1d0271", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:caa44731-374e-5adb-a76c-109a5dbf249a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:d733c785-a0c5-583b-933d-a3ad5fae146c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:48a860d5-167a-5da6-92c2-41257b4fc78a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:dbc53146-e876-5362-8876-0941229c66fc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1bc604dd-dc9b-5d3f-afca-4759ebd4961e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:5b59fcae-09e1-573c-a79c-8db5f204d3a6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e6b0ca95-015a-5e6d-bf46-498e53fe7fe0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:066fd110-8620-56e2-8f14-5ecb4f48e797", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ], "bom-ref": "urn:uuid:3f88b8b7-617c-5afd-9b13-dd59d69eec24", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.4" } ] }