{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0f57c09d-df65-5a25-ac9e-c5272fcd8e17",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "dompurify",
      "purl": "pkg:npm/dompurify@3.0.5",
      "type": "library",
      "bom-ref": "pkg:npm/dompurify@3.0.5",
      "version": "3.0.5",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-45801",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:7274fd75-448b-51f0-a842-6c824c285da6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-45801 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2024-47875",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:8c2f1e07-c0a4-5d51-8774-29194e1a4155",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-47875 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2025-26791",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:3338a1ba-92ed-56c7-82ad-94447f9d5269",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-26791 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-41238",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:cb65a292-4214-5878-b594-8c4aae64e489",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41238 affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41239",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:fcf11f93-8668-539b-b987-940694b2d254",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41239 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-41240",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:db6db837-d612-5ff9-b9f4-447a7e6ee8ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.5 of dompurify. not_affected \u2014 CVE-2026-41240 affects DOMPurify versions 3.3.0 and later that support function-based ADD_TAGS configuration. Target version 3.0.5 does not have this feature (introduced in 3.3.0, October 2025). The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck mechanism to bypass FORBID_TAGS checks via short-circuit evaluation - this mechanism is entirely absent from 3.0.5. Version 3.0.5 uses only arr...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-49458",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:0092b3da-a1c8-5f2d-a4a9-992c4918e81b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49458 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-49459",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:38709cac-7149-5cd9-bf50-1749fdec46dd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49459 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-49978",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:8233d7aa-dc19-568b-9fd6-8f2adaf5d8e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49978 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65898",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:0b617687-b04b-54d2-a5ed-015f0f96a837",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65898 affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65899",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:95c68d18-c38a-5c6d-a551-8e56172d70a6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65899 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65900",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:1898cd12-8f47-5005-ac1e-a79912741eb1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65900 affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65901",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:8c5216ed-f89d-57b0-9550-cc66a877847a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65901 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65902",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:868d6cc1-8b1e-5b27-80d8-2b67b5896fab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65902 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65903",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:b1bc3c8b-ec52-57fb-b7e1-8d47bd3e8485",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.5 of dompurify. not_affected \u2014 DOMPurify v3.0.5 is NOT affected by CVE-2026-65903. The vulnerability is a regression introduced between v3.0.5 and v3.3.3. In v3.3.3, the condition `!(tagCheck(tagName)) && (!ALLOWED_TAGS || FORBID_TAGS)` allows tagCheck to short-circuit the FORBID_TAGS check. Version 3.0.5 uses a different architecture with an explicit guard `!FORBID_TAGS[tagName]` at line 1019 that prevents forbidden tags fr...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-65912",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:f7a1bb89-ed9b-543a-a91d-b6d6a539024c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.5 of dompurify. not_affected \u2014 DOMPurify 3.0.5 is not affected by CVE-2026-65912. The vulnerability requires the EXTRA_ELEMENT_HANDLING.attributeCheck feature, which allows ADD_ATTR to be specified as a predicate function that can bypass URI validation. Version 3.0.5 does not have this feature - it has no references to attributeCheck or EXTRA_ELEMENT_HANDLING, and only processes ADD_ATTR as an array via addToSet(). Without t...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-65913",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:8bc2f4d1-903d-5fbe-9d69-867842894ae3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65913 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "CVE-2026-65914",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:8eed72c8-6324-56c7-a593-29acb2a95456",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65914 affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-66010",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:abde5661-dfa3-5ebc-b04b-d48a87150559",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-66010 affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.2."
      }
    },
    {
      "id": "GHSA-55q2-fjhq-7xh7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:0ceead78-ff10-5801-a3d0-a1a0110a5a46",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.5 of dompurify."
      }
    },
    {
      "id": "GHSA-6688-9rhm-gjv2",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:2ccdd283-bce7-5bac-bff0-55301fa721c6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.1."
      }
    },
    {
      "id": "GHSA-c6gr-qvv4-5v3f",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:37da43bf-2e40-5943-96e4-afc0dfea83cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.5 of dompurify, and is fixed in 3.0.5-tuxcare.3."
      }
    },
    {
      "id": "GHSA-jxrp-r7gx-q4j8",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:d39a27b9-7bb9-5a42-9692-7f460e51bbaf",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.5."
      }
    },
    {
      "id": "GHSA-mrv2-3pqr-j5jr",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.0.5"
        }
      ],
      "bom-ref": "urn:uuid:3eb379a7-296a-5517-a9e3-1b738d876e2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.5 of dompurify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@3.0.5"
    }
  ]
}