{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:73c3bcdf-666e-557e-919d-6227e438cc3a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@2.3.3-tuxcare.6", "version": "2.3.3-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3", "type": "library", "version": "2.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:881cac9b-a878-5b69-a962-fd2dcdb9ab3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e11c6ca9-6c1e-593d-aaeb-a8202791ac07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d0f78f16-7c34-5ecc-8b90-e5e54826bad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:316e0079-31a0-5bcf-ae21-4409e332d7c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:c454e509-4fb0-52ed-9ac3-7b2229685d83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:2d6319dc-760a-5550-87c9-9bb7b24a6a7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:87125507-842e-55eb-b607-62a7f4e57355", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:aa88b5dd-ff62-5eb7-b283-510f67780b6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:974f8401-7c90-5f3f-a231-251947b6ed01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a263ab2b-c5e2-504e-8251-82f90d113eb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ecf98524-b194-5d5c-9888-b0173f23018e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:da219a02-bc47-51db-8b2a-e73a56cb30d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e3f6875a-a1f2-57be-8a50-244cbeb3c6fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4a737ffa-775a-50dd-8892-394c60984b43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:32b1cfcc-0716-5f13-879e-5f804a3052da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4513e86f-9954-5d68-ba91-ac370624d370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a0a090fb-c702-5546-b6df-0ef745ae9482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:5c20c806-b517-564b-bdc5-a7d70849a832", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:bb6c8a23-7e45-52ad-bd48-a27694a3df43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ffd27a2d-ec50-5284-a50b-bf73893521f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:37f275fc-f131-57de-85ea-a7a136c7f067", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.3.3-tuxcare.6 of dompurify. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-66010. The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which was introduced in version 2.3.4. Version 2.3.3 predates this feature and therefore cannot process the attack input (HTML with custom elements when CUSTOM_ELEMENT_HANDLING is enabled). The vulnerable code path that allows custom elements to bypass afterSanitizeElem...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:81d26667-1ea9-5e16-b17e-babe70fbf436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e6ada0d0-b012-5853-a36a-95706a5692e9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:68b23ea1-b15e-5385-9668-f2aa02abe0ec", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ed9fa9d0-f054-59ef-aea2-fdfe4eb021cc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:14d81fc7-1e5c-574b-88bc-80f0fd1b0222", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.3.3-tuxcare.6." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:82f6c437-1aea-5405-bc49-cd8d09e0d26e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 2.3.3-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ] }