{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4efde641-3284-5846-8fff-674096597da1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.5-tuxcare.1", "version": "3.0.5-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5", "type": "library", "version": "3.0.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:d085ec91-43c6-57b1-afde-1c9ad151da40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:79a59137-4745-5621-9ee5-cf924f1a0cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:47f9d285-e276-545b-8cb4-ec4f61fdd4fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:d53babb4-ff70-50cb-83a2-484fc8d82e25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.5-tuxcare.1 of dompurify, and is fixed in 3.0.5-tuxcare.2." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:efe699ca-785d-5ea4-a1ff-083a41f5219b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:a649f875-f4af-5c91-a455-bd51d72dd6a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.5-tuxcare.1 of dompurify. not_affected \u2014 CVE-2026-41240 affects DOMPurify versions 3.3.0 and later that support function-based ADD_TAGS configuration. Target version 3.0.5 does not have this feature (introduced in 3.3.0, October 2025). The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck mechanism to bypass FORBID_TAGS checks via short-circuit evaluation - this mechanism is entirely absent from 3.0.5. Version 3.0.5 uses only arr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:7369da4c-8b0d-55cd-9eb7-9fd8a0d307d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:34bfd6f3-188d-51e4-94c1-9bde7ff2ba8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:a35c7970-6fb9-5b77-8908-37ecad0b4b33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:307e7885-8d00-5209-8d81-c789d7f35315", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.5-tuxcare.1 of dompurify, and is fixed in 3.0.5-tuxcare.2." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:8ccf4d86-e606-5756-8abc-21d117ef56c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:12349a0d-68a2-54a1-8c3c-8214ea281200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.5-tuxcare.1 of dompurify, and is fixed in 3.0.5-tuxcare.2." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:a0eae2d4-cafa-5c01-8b3e-04e84d9b6f85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:e1caada2-d40d-5027-aa73-fb3c1cc967e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:973c9cd2-d0c2-5787-8ce8-8b714eac65b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.5-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify v3.0.5 is NOT affected by CVE-2026-65903. The vulnerability is a regression introduced between v3.0.5 and v3.3.3. In v3.3.3, the condition `!(tagCheck(tagName)) && (!ALLOWED_TAGS || FORBID_TAGS)` allows tagCheck to short-circuit the FORBID_TAGS check. Version 3.0.5 uses a different architecture with an explicit guard `!FORBID_TAGS[tagName]` at line 1019 that prevents forbidden tags fr...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:e3a6bea1-ce9b-5834-87bb-bf814189a7b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.5-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.0.5 is not affected by CVE-2026-65912. The vulnerability requires the EXTRA_ELEMENT_HANDLING.attributeCheck feature, which allows ADD_ATTR to be specified as a predicate function that can bypass URI validation. Version 3.0.5 does not have this feature - it has no references to attributeCheck or EXTRA_ELEMENT_HANDLING, and only processes ADD_ATTR as an array via addToSet(). Without t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:75e516cc-f271-5fe2-a5f5-598ce3339da0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:fdd00d24-91d2-59fd-9248-95324ccc0091", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.5-tuxcare.1 of dompurify, and is fixed in 3.0.5-tuxcare.2." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:c176a427-c3da-5224-b2c2-d80e17ae03b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.0.5-tuxcare.1 of dompurify, and is fixed in 3.0.5-tuxcare.2." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:03071c41-a46d-5920-bbd2-837ec741a8e3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:9926cb47-eff6-57fc-9bda-41ccc5802128", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.5-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:c03dde4c-5ca1-563c-b940-03e609f82fd4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.5-tuxcare.1 of dompurify, and is fixed in 3.0.5-tuxcare.3." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:aa2630db-4f0a-5861-85ad-e788c5f80d27", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.5-tuxcare.1." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ], "bom-ref": "urn:uuid:c3ed48ce-b34a-5e5c-9f63-9ec3a4eb4173", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.5-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.1" } ] }