{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1fc38151-8c6d-5b8f-90e7-907d65872f2e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8", "version": "19.2.21-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:3902b338-de66-5b25-a3e0-0ecb2df8beae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.21-tuxcare.8 of @angular/bazel, and is fixed in 19.2.21-tuxcare.9." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:f928b530-6417-552f-a0d2-d2db116ff05b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:9540cc40-c971-5a4f-832f-8950cd84c2b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.8 of @angular/bazel. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:309ee4ff-7696-5454-bb44-2134fa8b64d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:94e6da36-4b2a-55ba-baa0-d48560a128a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:eb2b36c3-c178-5465-9b2b-5d2e0fa91443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:a9c5347a-c746-58e9-9fd2-8798bf5841c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:e54e6077-f17a-52f5-ad6b-2eb4acfe2e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:31176af5-3dc5-515a-ae25-607b56c82535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:b18cddd3-c19f-5296-90e1-94d5dfe81283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:ecdf4385-9755-5513-8c8c-7d4c42b8fc14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:387ef170-ddf5-5689-9b8e-6825bf07e11f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:0e51d4e0-8a92-50a6-acfe-a60fc86f047e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:33c7e741-6fef-5b27-81d5-fc55fa072924", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:45e738c1-ce58-567b-a709-1b99926f6136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:dde2768b-8a41-51fb-9884-c624f462aefb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:442c3277-e705-5e36-813b-b63d4bf3d20c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:9717ac66-c3e0-5bd8-a51a-12f05187ae1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:3a50ffd0-499a-5174-b183-decb97c28c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5ee23362-c0c9-5d30-8926-d40f3041a7f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:98cfeb27-d3c6-56cc-8c22-fcdf1bcd36c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:57aa6077-8c39-5f2b-9706-1ab94ef8ae3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.8 of @angular/bazel. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:a2a27cfa-2b31-5bc4-ba15-174d0d0d2549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:3768f027-d81e-568c-95cd-a283a127daef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:d7c94d3f-2419-579b-b794-aad3115b124b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:10630532-1d04-52bd-8a41-fe35804464cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.8 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@19.2.21-tuxcare.8" } ] }