{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f41d7d4a-ddf1-5f1b-bcb0-be1cbe7d0299", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.3", "type": "library", "name": "dompurify", "version": "3.2.3-tuxcare.3", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7276ed3b-333a-5819-9c5a-4a322d0e702e", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:036479c7-f907-5a98-8736-d5ce508bae26", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:65c82cfc-73f3-5233-b13a-dd8a51911c5b", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6521100a-07a3-58d0-b60e-7e4796e8e528", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:286200c6-f45f-5820-8fc8-e8a2443d79c6", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d7385272-04b3-5d47-affb-b206a6c6eaaf", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e3306bd6-e0e5-5143-a84d-0d8e045c3ca3", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:01d80326-14e9-5e07-898d-dc4b0d285124", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:96201a8b-4865-57b4-a058-17dcbf5212e1", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5487050d-c4d4-53e5-b47d-e35a12918019", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7beb629b-22cc-5a38-a9c5-2722712053d4", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d2f9223c-50cb-5d66-9277-33b768a82f0c", "id": "CVE-2026-65900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a51b7e8c-11e4-5779-9158-a9aa1ca10a49", "id": "CVE-2026-65901", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:359d6da1-e076-56b9-8c78-9fdf3329bc98", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee7dd031-68c5-5207-baaa-44c24cb8a24b", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.3 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:73f153ea-0372-5072-831c-11d54a11339f", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.3 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1bb09b92-a23c-5855-9de2-f97db3ed982f", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bc972ab6-6964-58b9-abd3-b9ad7a64267f", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:88231ce4-edd4-5380-a151-809e94264dde", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4c4310d5-65da-5a5e-923a-46c9e909f6a8", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:21f0a8d5-dea8-5adb-9bf1-9353084129c8", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:32e3a290-f1dc-55c7-a443-1cf57eb98ee9", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:77e1cd98-2e77-5ce1-bfc0-799e04aba4b2", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9fbf9bbe-fadd-583b-b590-d012a9d507fe", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7e0d05e6-4ef1-595e-b0a8-7a74d1a4e16b", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f04ebe33-9ab8-58ff-a259-e47d3e030575", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8b4043b1-2d13-563a-ba18-e4cfac39d782", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6d9f5f57-340b-5042-801d-fe3c90bcd29b", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8177e523-9bd3-528f-8a58-10d6a58aa275", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da29a239-7c6b-51b4-8ff4-11453b78d2bf", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.3 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.3" } ] }