{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dd5ca23b-f942-5a3f-ace6-05dcd540cf2b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@18.1.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8", "version": "18.1.2-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:77371b98-4b03-53ce-a8bf-b8e57b67e81b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3948ebd2-df72-56e5-9263-fb22b6aba7a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:5a8e9724-7bbf-5245-b1cb-1d29e9e41ae5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f4ed6b44-d1f7-5fc8-8293-981f362020dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:0a5dd0d2-dd20-554d-b898-520d8460882f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ab0dde9a-0ee9-535a-8139-52885f8fd694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:9efc90cd-9b5a-5bea-b17f-d94a328b23ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:885a9e6c-d508-5ad2-ac9c-c41f3eb879f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:603197ae-8747-5c8b-8140-96105388a718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:8e3447e1-0b04-55c9-bc69-0199f19786ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:7ebfba04-dc40-5567-895b-5d2fcc05a3b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:e681d4a0-eace-5775-bc7f-c11619239bb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a3e897a4-1f84-5e5f-832e-34eab141a7e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:431f102a-7c3f-5cc4-83ba-bb38f66c84ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:56a4a1d3-c68b-54ff-b950-de13d88d8107", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:5a07a66d-8b70-5432-8328-c09b888bc3c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.8 of @angular/common. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:8c5438e7-7e44-5573-848d-62e32a09f6ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.8 of @angular/common. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2db16cf8-d420-574d-a95a-f6546567715d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:09e671af-e5f9-5a43-931f-e9a96983191c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:4238313f-d860-5496-855e-a36d4b063a0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:55bc8f07-08ef-511c-80b5-6590a5aa93fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:fd9c564e-3e5a-54be-958a-f4b43ff9a76f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b7b8277c-7c39-50e8-a5cd-65a6c94d7bc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b736e616-b288-51b3-a7d5-1fb14ac9cbf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:4e7fb950-1913-5395-aa9e-51239b7b47ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:84af28e5-65fd-5a92-ad5e-b2b58ec947c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f7f1a6ff-1b10-5c76-b5af-17a070da037d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:4f994829-0bfb-5ae5-88e0-1a1a23eb661f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.8 of @angular/common. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3c2213ad-4f78-5877-84b0-2d2fd15722c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1973c6ed-1220-5dfb-8744-261313418b72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f7b36996-c1a9-5a44-ac1e-6206c7adc6e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:216464ea-721a-557a-ad95-85a3c58155f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.8 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@18.1.2-tuxcare.8" } ] }