{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61066e57-e130-5ea8-adaf-f0c2f8453f27", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8", "version": "19.2.21-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:519e1a20-981b-522b-af4d-074a898510a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.21-tuxcare.8 of @angular/compiler-cli, and is fixed in 19.2.21-tuxcare.9." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:76aa716f-ca0b-5002-8e1b-5cb9ed45ab27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:17959c3b-1501-557a-8abd-1f167ff4040e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.8 of @angular/compiler-cli. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:03ffb827-195c-594f-af60-94a8e9342cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5f9f5b42-a1c7-5dca-b2c3-c44edb4452a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:ad7ee236-ca6d-51cc-bc5b-0195e939abb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:ee5a5895-e005-5b12-a7b1-0c8cf7179358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5284a0b8-c102-552a-a52a-6cf65f1da28d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:8e089538-4454-5e49-b35f-6ab4da32048f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:7f837ba9-933c-5ad5-a8bb-a939a62e0338", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:42ed9f27-a071-5851-9f02-088ab375e511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:eb5674e2-deac-51a3-b9e2-ffc49f77a469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:48db0a49-f69d-5c5a-a3b4-7955dfb27f3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:180ff85a-f4e8-5bc1-afeb-1a95649c3272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:69f9be06-a13d-59a6-8ca3-6a7db6fc1f6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:b1a4aa28-9d55-56f1-847a-6029c01d33c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:c3e18570-e976-5460-a3cf-dfa42e7f2407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:420b8ac7-1bd8-55fd-92fb-3a994693aefb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6faf455b-ee16-58a3-a7bd-47e2dedc0f58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:f15292a2-5cdb-5d14-927b-9654368c4b47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:d70ee8d6-426e-52a7-8513-c101f277e53f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:db0f13f2-3993-5044-903b-509f1e310629", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.8 of @angular/compiler-cli. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:258eeb15-2f68-51ad-920f-20aaec96cffb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:c81238ae-8c24-5d3f-9e75-cdbd1e917d26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:d8037cce-c4c9-5702-a274-caaa93558bac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:9e26e5b9-7322-5543-9262-43fca721e915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.8 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.8" } ] }