{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:797ea21c-a504-5dd3-bfa7-84742e5a9c8f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "dompurify",
      "purl": "pkg:npm/dompurify@3.4.11",
      "type": "library",
      "bom-ref": "pkg:npm/dompurify@3.4.11",
      "version": "3.4.11",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-109345",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:08e8a76b-69d6-5883-a465-22ab3e0dd56e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-109345 affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-116802",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:88a2c9bf-ce8a-578e-9a29-bc221af0665b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-116802 affects version 3.4.11 of dompurify."
      }
    },
    {
      "id": "CVE-2026-116803",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:267cbe13-d862-5f1b-b97a-627cdef371b4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-116803 affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-116804",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:69407d04-65e6-5a2d-b09c-2b97786c0066",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-116804 affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-65902",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:954ed48a-191b-5c29-9d2f-e18648b9ad8a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.11 of dompurify. not_affected \u2014 The target repository (DOMPurify 3.4.11-tuxcare.6) is NOT AFFECTED by CVE-2026-65902. The vulnerability was fixed in upstream DOMPurify 3.4.7 (commit ca30f070) by Cure53, and this fix was already present in the upstream 3.4.11 release that TuxCare onboarded. The fix adds defensive cloning of ALLOWED_TAGS and ALLOWED_ATTR before hooks execute, preventing hook mutations from permanently widening ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-66010",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:4aed5727-3676-5d63-a330-295ca11b759b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-66010 affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-75838",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:381a4e72-84f3-536b-b2be-f15c8afcb3ee",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-75838 affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.2."
      }
    },
    {
      "id": "GHSA-55q2-fjhq-7xh7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:77052954-c27d-570d-a7a9-e44fb4aac205",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.11 of dompurify."
      }
    },
    {
      "id": "GHSA-6688-9rhm-gjv2",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:96264e89-cea3-557b-92a8-1e894b1253e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.11 of dompurify."
      }
    },
    {
      "id": "GHSA-c6gr-qvv4-5v3f",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:365130e4-08a7-5c9e-a8b8-a731671386f2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.4."
      }
    },
    {
      "id": "GHSA-cg2g-xh64-v4q7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:a9f75628-2e84-5337-a7f9-884af953c969",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.6."
      }
    },
    {
      "id": "GHSA-jxrp-r7gx-q4j8",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:16eb7c1b-a8bd-5691-b8b3-5ef7218a2451",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.11."
      }
    },
    {
      "id": "GHSA-mrv2-3pqr-j5jr",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.4.11"
        }
      ],
      "bom-ref": "urn:uuid:9e205181-c26c-596e-9f6d-54048f6e84cf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.11 of dompurify, and is fixed in 3.4.11-tuxcare.5."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@3.4.11"
    }
  ]
}