{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f7f641e4-4640-5f81-b693-2f1216a4bf92", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6-tuxcare.1", "version": "3.0.6-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "version": "3.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:c506e06d-4c49-5c12-927a-a9a9bb19a89d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.6-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:a9e3b139-718d-5f00-a4be-653cc97856a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.4." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:ce0aa2fc-d6f8-5669-a445-e21f9e00a4ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:86e02705-37b2-5a99-92f2-a4c24ffbd7ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:50a50fef-01f5-5c80-b448-38fe9c13125f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.6-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:4f5ef5f7-3024-59e4-85cf-3ff46c811e8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:8246202b-0b01-5bd6-b6c0-b5b96d206748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:db3e987e-e698-5afd-a0e6-c38703bc0e3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.6-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:82ecf628-0eba-56d6-9718-141e5d7a95a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.6-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:747117c8-76ce-5e7e-be8a-a7b1337851eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:5c85e980-6d8a-57ad-bfd8-4a7e13f62d38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:0a2d6efc-3cb7-5e89-a2ca-67b3fcd9d5de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:1cc0046c-d6ca-501a-ad5d-2a0d920d4606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:8a224b24-7e08-5f6c-b70a-01dc2d9abec6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.6-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:e7be74fa-5722-5998-969d-e9f48e8d0c02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6-tuxcare.1 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:979413e1-cab8-5de0-89af-1ad7a2690b6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:b4c00a88-a91c-5b65-b2f7-6cb4e88f947b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:8fd07afd-540f-5e8c-ad3c-3796a873b9b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.3." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:2a991c91-8af3-5a05-b5c4-6e32cb78cdd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.2." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:3359d1eb-6fc2-5b6f-8cfe-df1348d23e89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:6091a7eb-c8cb-51b5-9e0d-f61876e64554", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:76d8210d-1938-5ab6-93f9-dcd4f3c9164c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.6-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:763d8e76-bd95-54f5-96cf-f781a6839a76", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.6-tuxcare.1 of dompurify, and is fixed in 3.0.6-tuxcare.5." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:4f31235d-ab25-5992-8659-bc4147317647", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6-tuxcare.1." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ], "bom-ref": "urn:uuid:a4a19707-a964-52aa-89c8-45fd85bec4ce", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.6-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.1" } ] }