{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:31c7f966-7b1d-5910-8576-6b3a88846494", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.4", "version": "3.2.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:78b45a2c-35ec-5026-b387-d8473af599f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:8b905851-e118-51de-8ef2-d061d435d78d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:00a9f8ca-c00c-5f50-9887-d907b116365a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:73243a2b-2189-5277-b476-1d2d43d39dd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:e035b501-728e-5a48-9b6b-6666c21ccda7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-116804 does not affect version 3.2.4 of dompurify. not_affected \u2014 Target version 3.2.4 is not affected by CVE-2026-116804. The vulnerability requires processing of attached shadow roots (created via element.attachShadow()), a feature that does not exist in version 3.2.4. The CVE affects \"DOMPurify from 3.4.4 before 3.4.17\" and was never backported to any 3.2.x version despite active TuxCare maintenance, confirming the vulnerable code pattern is absent in the ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:9d0bd422-dcc3-5acf-9ad5-a6fc8c4e2b99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:c7b2cbf7-1201-5cbc-8d3d-caafc106b9dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:1a5bf0f9-bbc1-5de1-83cc-72046eae1618", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (per CVE PoC: `ADD_TAGS: function(tag) { return true; }`), but this feature does not exist in version 3.2.4. The target version only supports array-based ADD_TAGS via addToSet() (src/purify.ts:622). Function-based ADD_TAGS was introduced in October 2025 (commits 6c08b7d1, fa239f04),...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:88dc3858-4521-59b4-9ee5-a1d6f5a6adbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-49458 does not affect version 3.2.4 of dompurify. not_affected \u2014 DOMPurify 3.2.4 is NOT affected by CVE-2026-49458. While the vulnerable realm-bound `instanceof` checks exist in the codebase (in `_isClobbered`, template content checks, shadow root checks, and namespace validation), the attack mechanism requires foreign-realm DOM nodes to be accepted for IN_PLACE sanitization. Version 3.2.4's entry-point validation (`_isNode` at line 1452) uses realm-bound `i...", "justification": "code_not_present" } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:811ad38a-2b94-590d-85d4-e2b354c223bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:1010234d-f56a-5d1e-9137-af07a5fddb71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:900cf10c-cc0c-5615-a165-63ac35b4d3fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:7df26907-818e-5c6f-8670-7a5e361268a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:06a99670-6dde-5044-a2fd-06b0537c3ba8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4248867b-b588-51cc-9e3d-61351a6133dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:f9470a83-8bcd-54d7-b799-7fe8de84f32f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4d7eac9d-b848-5640-a8d5-2cb5bfc27927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 does not have the vulnerable EXTRA_ELEMENT_HANDLING.tagCheck feature that enables the CVE-2026-65903 bypass. The ADD_TAGS configuration only accepts string arrays in 3.2.4, not functions. The feature allowing ADD_TAGS as a function (which populates EXTRA_ELEMENT_HANDLING.tagCheck) was introduced in version 3.3.1 via commit fa239f04. The vulnerable code pattern where tagCheck evalu...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:02a4a054-6212-5f5c-830f-83740222e2a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 is NOT vulnerable to CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (via EXTRA_ELEMENT_HANDLING.attributeCheck) that allows predicate functions to bypass URI validation. This feature was introduced in upstream commit fa239f04 (\"Allow ADD_ATTR and ADD_TAGS to accept a function #1150\") and first appeared in version 3.3.1. Version 3.2.4 predates this f...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:6d2c6097-06e6-539c-adfc-8834192f256d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:a156716b-ee6d-591e-bbd1-ffeb94d292e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4dc37a82-1374-5d49-898d-8cf69c09a907", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.2.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:6495912e-bba8-56c7-9ee7-72fea74bbef5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:5fbd6e36-2e4c-5c2a-b93a-19e53716e7ce", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.2.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4a910ac8-861c-5e4f-820d-20b322d18044", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.2.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:3b45732f-2a22-5c64-8a3b-d0b9684a571f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.4." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:cab5e26f-b0da-5db1-88d9-3bce1fc87137", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.4" } ] }