{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72f8def8-646d-56af-93a7-1ab1c8d8ab28", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.3", "version": "3.2.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:954b49f5-4401-584e-b3d9-0abd70d89bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:82dc7bab-f989-5b06-b6ef-b48fbdab1b98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:01c15490-2677-507c-a483-b551c403afc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:19eb27e2-3fb3-5df0-b297-200f22d1aea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:f839ce1a-8d0d-592e-9cf9-f582d4446e4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:79a68108-0286-5247-9b13-19f1c3fe6d85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:cf5a7b57-8168-56b3-97d7-ba8aa4817c62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:129fb844-70ab-58ca-b40c-dbff77ca3b55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:af3a9898-9115-5f24-be0b-0627417350dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:1f63e0c5-e53f-57de-93c2-3f8a8cadb531", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:db39931f-aaf9-5043-8c7c-7658e4e24e80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:8082226d-d26a-50fc-8aa2-b8ad170a3f4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:8dc15366-e886-5ef7-923e-5602dc8be070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:7110f37a-742e-5531-a1b2-e14cd91d9760", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:0d14aa72-3a6d-58e5-aa9f-2e087615c2d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:141a3dde-55ef-5bec-912e-9c9966410921", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:c15ba4e9-adea-53e8-abf6-5ad5117c572b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:eecb338e-53fb-542a-8fda-b6640e08c735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:1bfb1dbc-51f7-5cb8-abcc-5aa64d531f73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:d22cbd09-c519-5932-a7e9-aad2354c3d39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.4." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:93cb66db-7ee5-5bb3-8247-d75c6a8fa124", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-39q2-94rc-95cp affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:65a5f1e0-bd7d-57a1-91a8-66fbf763b660", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.3." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:ec2889f7-b101-59bd-934d-e3cdd5555602", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.5." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:407e66d2-b309-5bc4-823d-5430c79cf570", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-76mc-f452-cxcm affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:4eccdfb8-5fab-5bdc-b50e-7fc1c65e053f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:21f7e3cc-ce22-54d8-a994-1c70ba60e1d2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.6." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:8bb4d972-110b-5e3c-bc03-6caacfc87f43", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:f2de041c-ec8f-5eb8-ae9a-6b0c9c1f147b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:fe9b89ed-8903-57d9-ace7-7ad023215bb7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:ee7b4a90-278d-5d0d-a119-8317fd13e4c5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:2bc6e296-6a7d-5306-ba65-d4c164c364e7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.1." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:a7d677e2-dccc-5536-b3a3-3cfa4de6a923", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.3." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:74e48646-da96-59a7-a752-4b59216cca37", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.3 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:ab222a8b-513a-5fca-b14d-6a2436279de5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3" } ], "bom-ref": "urn:uuid:2d780d89-7789-5131-b8cf-b65b0051f059", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 affects version 3.2.3 of dompurify, and is fixed in 3.2.3-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3" } ] }