{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:65c0632b-31e7-58b9-881a-4b3baad725bc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9", "version": "19.2.21-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:465e5746-25c3-5cc1-925a-67ed8556746f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:d0c83168-7e2e-5aa6-bcff-2130b8cfb2b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:7685fe58-3cd6-5f1b-8f13-de93ba9771ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.9 of @angular/compiler-cli. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:ce047653-78e5-587e-8f12-228f504aeb5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:621914ac-4dcc-5711-b5e0-35479919848c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:7355b941-48ff-5397-9558-f83e96ae48cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:aea6f438-7851-51c6-af53-9eec47a07923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:e0e920b4-0fd3-5237-9a89-e50bad4d9d12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:ea0e6ce7-fc03-5ae3-8057-7ce65188f495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:db5afc6a-ea6b-5fd1-b475-7ffea9d40f29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:504b837e-ff51-5000-80b6-76f375dbce0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:7b1f68bd-5eff-5fbf-b691-dcc21c97f63d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:baa27372-8ee1-5834-a31f-a127f8323c4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:7c3bfebf-57bc-528a-83ef-f43d8dd38607", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:62c4773a-76f8-55e3-8fdc-97a4b7a2eefc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:50cb9b72-157f-5f3b-80f8-3851a9c9eedf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:445dc065-9d0b-5ac0-9b2d-a0b917a70d9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:a9e0c4c5-b70c-5492-80c8-b6c5ef7417e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:b7a0fdd0-b5a7-54e9-bcd8-5c4b4abb1a34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:381a6b2b-8683-55d1-8f41-5b39448f3360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:9d22b899-a226-50b6-9df1-4a826e50a570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:b2f5ca4a-36da-5bf0-8a89-c4b989b622ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.9 of @angular/compiler-cli. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:c97a3e6b-b541-5b65-bf27-8b1922b433fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:dc1590d5-439b-5cc8-a15e-46b762bdd061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:6985eb28-ed3f-5846-a3ca-f7dc9441e4d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ], "bom-ref": "urn:uuid:bcf421b8-152b-54a8-a957-1df51886c83b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.9 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@19.2.21-tuxcare.9" } ] }