{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:00e54005-15d0-59ad-821c-a38ee1855d38", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8", "version": "18.1.2-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a58869c3-0f18-5d8c-bbd8-6bc099a6a08e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:0d70ce0a-d934-5f2c-be39-54b81349a733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b55697d2-d014-507f-b2cd-5974b2673482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b46e9329-efc3-58f4-afc7-c16c6a69db74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:accc162e-21d5-55cf-8183-6f40a59d1218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:423f26aa-de0b-584c-9747-4c38d8f744be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:0d1cf7c0-b699-58ce-b99a-95e7276a65f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d9ffd4b1-e097-5cef-a5e4-1594c4631074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:df505ff0-6a6f-5279-a641-969b8499ca27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:027347b2-706f-5471-81e5-29d8d96d3184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:187c3134-96d1-5fbb-a391-b1a97fe70d41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:bd71be03-073f-517e-99a6-a8450d9f0a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:322715a1-1c69-50ce-b129-1f1f60ea1805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:33eb2601-ac87-504e-981f-b5566d86ffb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:39af6f0c-7891-5eff-9bba-92a4f402b27d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2b10bd0a-17be-5560-a1d9-ec47ffc87fe9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.8 of @angular/benchpress. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:63074812-fbba-558f-a848-4d1d6f2cbfce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.8 of @angular/benchpress. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b47e921e-d0fb-5cf4-9cbc-8613c2b4cec7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b3a2963a-507d-5f33-88c0-718c1e0ca026", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:cd684636-6153-5df4-821c-8588eb3a7ed7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1ae1e3df-525c-5141-a191-ca43677ca2b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ff44326f-d582-51e4-aae0-0f6229807143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:80ba53d1-fdc3-5344-9a59-d6d430f1916e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a9a43133-a435-5913-934b-62a89e4e308b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:548bf4b7-67d0-5665-a456-5c837797aaf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:44c812c1-c8cf-551d-90ee-dcdf9ad25a7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:57bc8d49-0b9d-571e-ae94-552c5ebd2d0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ad8a7b91-40df-53f1-87b1-f1b50e64bf16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.8 of @angular/benchpress. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1eaa3f62-a39f-5a87-aa65-ea3fdec65e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d802325c-f7f1-5599-8e09-7a2bf6ebdc20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f0c46759-bfdd-5bd7-afa5-8644b337afaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:82f681d8-4cef-54d7-8455-2ee7a9f3b306", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.8 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.8" } ] }