{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:31e31385-b8bd-52e7-9791-896a241e489d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.4", "version": "3.2.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:78b45a2c-35ec-5026-b387-d8473af599f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:8b905851-e118-51de-8ef2-d061d435d78d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:9d0bd422-dcc3-5acf-9ad5-a6fc8c4e2b99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:c7b2cbf7-1201-5cbc-8d3d-caafc106b9dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:1a5bf0f9-bbc1-5de1-83cc-72046eae1618", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (per CVE PoC: `ADD_TAGS: function(tag) { return true; }`), but this feature does not exist in version 3.2.4. The target version only supports array-based ADD_TAGS via addToSet() (src/purify.ts:622). Function-based ADD_TAGS was introduced in October 2025 (commits 6c08b7d1, fa239f04),...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:88dc3858-4521-59b4-9ee5-a1d6f5a6adbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-49458 does not affect version 3.2.4 of dompurify. not_affected \u2014 DOMPurify 3.2.4 is NOT affected by CVE-2026-49458. While the vulnerable realm-bound `instanceof` checks exist in the codebase (in `_isClobbered`, template content checks, shadow root checks, and namespace validation), the attack mechanism requires foreign-realm DOM nodes to be accepted for IN_PLACE sanitization. Version 3.2.4's entry-point validation (`_isNode` at line 1452) uses realm-bound `i...", "justification": "code_not_present" } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:811ad38a-2b94-590d-85d4-e2b354c223bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:1010234d-f56a-5d1e-9137-af07a5fddb71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:900cf10c-cc0c-5615-a165-63ac35b4d3fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:7df26907-818e-5c6f-8670-7a5e361268a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:06a99670-6dde-5044-a2fd-06b0537c3ba8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4248867b-b588-51cc-9e3d-61351a6133dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:f9470a83-8bcd-54d7-b799-7fe8de84f32f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4d7eac9d-b848-5640-a8d5-2cb5bfc27927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 does not have the vulnerable EXTRA_ELEMENT_HANDLING.tagCheck feature that enables the CVE-2026-65903 bypass. The ADD_TAGS configuration only accepts string arrays in 3.2.4, not functions. The feature allowing ADD_TAGS as a function (which populates EXTRA_ELEMENT_HANDLING.tagCheck) was introduced in version 3.3.1 via commit fa239f04. The vulnerable code pattern where tagCheck evalu...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:02a4a054-6212-5f5c-830f-83740222e2a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.4 of dompurify. not_affected \u2014 Version 3.2.4 is NOT vulnerable to CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (via EXTRA_ELEMENT_HANDLING.attributeCheck) that allows predicate functions to bypass URI validation. This feature was introduced in upstream commit fa239f04 (\"Allow ADD_ATTR and ADD_TAGS to accept a function #1150\") and first appeared in version 3.3.1. Version 3.2.4 predates this f...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:6d2c6097-06e6-539c-adfc-8834192f256d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:a156716b-ee6d-591e-bbd1-ffeb94d292e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4dc37a82-1374-5d49-898d-8cf69c09a907", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.2.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:6495912e-bba8-56c7-9ee7-72fea74bbef5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:5fbd6e36-2e4c-5c2a-b93a-19e53716e7ce", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.2.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:4a910ac8-861c-5e4f-820d-20b322d18044", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.2.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:3b45732f-2a22-5c64-8a3b-d0b9684a571f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.4." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.4" } ], "bom-ref": "urn:uuid:cab5e26f-b0da-5db1-88d9-3bce1fc87137", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.4" } ] }