{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a5bec08d-1470-5e6c-a7df-3f31208ab0af", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8", "version": "17.1.0-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:b5d5bbea-782a-5bf8-8e4c-f8f4fab13315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:558899cb-3fc6-518d-9eac-2059fc7d5b11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:cf07de93-abbe-5b1b-b4a8-b9c95fd24fa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:1c7555ed-c78b-54e1-b5c3-944b22686ae6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:cc02c298-a593-51bc-9a4f-a8af75042d0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:83233674-622d-59e7-8d0c-78d07d2e8320", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:b32f4b8c-75cc-5fd3-9be6-d8a26df734d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:bf31455b-ad28-5443-9029-4c4e17ad0170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:1d47fda3-2f09-58e1-9a75-3e82225c2885", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:720f015e-da01-576a-96a7-25f7bbf77718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:850d5f3a-e943-591d-ae86-ab7f0688685f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:d902f380-c638-5388-8cc6-17e276d284ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:213f2916-0d63-5c5b-99b4-ed637fa90324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:a7a9b982-b867-5a07-8a19-70087a19c629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:fba9cc04-831f-5717-a45e-4e45b0414d89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:0ebfc6d7-8f54-5506-9cf2-9f3a94c55e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:398a67f8-04c5-54c9-b0ae-61e7ca83e246", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:10d4540c-ad7c-567b-8e76-4fd4fe3c19c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:3dbc28c5-ae56-51fd-aa17-7764ecfd8788", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:f619a580-d917-5858-9eb9-a46ceb9d160e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:996731a6-45ea-59e2-a79d-90d39fd5ab9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.8 of @angular/compiler. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:637ebe48-73c7-577a-aa88-229d94170a11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:e0671fef-1947-577a-bbd6-9626fc4ef903", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:6ffcebc5-158b-59a5-a7fa-e21d5bb6f7b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:aa25967b-b038-5269-b51c-4aca592ee939", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:fc89fa65-98d2-5163-808e-7d9810f0b5b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:faae6f82-1a55-5de7-bfc0-b226f617ccc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:085457a4-728b-5a4d-9f31-158ed0a85cfa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.8 of @angular/compiler. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:11991411-5cc8-5985-b7f8-fe764463ae7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:fc0c81a5-fcf0-5390-a71c-edd4599b7084", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.8 of @angular/compiler. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:70864c7f-a53a-51bf-9444-35be97f3fa1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:103c5044-8195-52bb-a0cd-450c9571473e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.8 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.8" } ] }