{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bc0f0bba-ab73-5ca1-a59a-0b4d1aaacfb2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@2.3.3-tuxcare.4", "version": "2.3.3-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3", "type": "library", "version": "2.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2354caf1-8e31-51e1-8a19-916f733665fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:6d08d79f-024c-5487-a3e4-72be09b4fcb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1310f500-aece-5db5-843c-d0f03761729c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:00cc7b5d-b4ed-5bc0-81b5-9a860cc382f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2f4f20bd-197a-5380-a9ca-4b1825dc2a91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c6cd149d-404b-59d8-82b4-fe7730c990af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e7f0e7c6-a280-530b-8857-d057ec5d2144", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1b03ccf7-6930-5471-aa5c-ff553be24cb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:f5f1edad-fb02-5be9-8ebd-cb1165ec83ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:884eaf67-bcfa-5c8b-8828-5475805554f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:aed501a2-20f7-58fd-914c-dfdc6e207d0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:5e12eb18-e704-5f2f-98c8-6b71b527cf23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:9bcb6d97-e673-5151-99fc-ece8c1f07681", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:279d1673-b7dd-56c6-b02e-ddf7e99591f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:3459176a-7d48-534a-b732-1623b1646cae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:235dea72-463f-5508-94e7-63c7f37c3a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1d5230ad-2999-5bc2-8d25-4e9125de8f29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1d46a7fe-8cf1-5ed7-af65-8f16ec0e6513", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.3.3-tuxcare.4 of dompurify. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-66010. The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which was introduced in version 2.3.4. Version 2.3.3 predates this feature and therefore cannot process the attack input (HTML with custom elements when CUSTOM_ELEMENT_HANDLING is enabled). The vulnerable code path that allows custom elements to bypass afterSanitizeElem...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2d259ffc-dddb-50e3-a45c-82ba27644d0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:ae2b0718-ff30-5fc8-8b07-ae24bf8452a8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:a41b8299-5bf6-5773-b84b-ad5382a83cd3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:648aa233-d1d4-57cb-ac08-01f521d48684", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:acca4d11-f69f-59c4-b05a-9c8373bd6f11", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.3.3-tuxcare.4." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:479712df-461b-56b2-8c63-7f49a5191fc6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 2.3.3-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ] }