{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3590470d-81f5-5dc9-b547-275e9a62265b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7", "version": "18.1.2-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:86be4eec-83eb-5f25-b667-9c3eb9c1b041", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9a78934e-8ab3-5a79-9133-d25b4ab83c66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9e924fa0-36f9-537d-916d-35b1d6738974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:59e40bb5-3867-5098-988b-de9f319358d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 18.1.2-tuxcare.7 of @angular/compiler, and is fixed in 18.1.2-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c988f3dd-9065-5d09-8806-13c4f9af9343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d89610cf-7d21-5866-8e91-d81fc3efc3c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e96387f8-14cf-5783-b0b2-5acf3e49168d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:ebdc093f-9613-5db8-a633-873022c852aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a14fb867-5509-5a52-976b-01545f21056e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9c8106af-83bd-5529-b4ea-0f0065923354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f3f4507b-190f-533d-aa03-b5cca09dccdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a32cb094-059a-5b4c-af75-e4b24fd01603", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:58cc3223-2c73-55be-9749-518ca9bdfd9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:87397a07-cf7c-5dbc-800c-64e34315a252", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:16be9291-23d9-5a74-af25-b510c725b7cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:114e42c5-4c19-58aa-aaa7-7677eddf19d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.7 of @angular/compiler. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f91398b6-91f7-5606-a6ff-b404cfa8ebec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.7 of @angular/compiler. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6b8ab175-c564-54c6-822f-3e7114100b26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:13b23f54-f342-5e40-82a6-22fe7487fb5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d72a7902-99c8-5aaa-8b2c-c10c042bfa35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:2a73f047-b893-5379-abb9-ae686b6ddc6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6dd7850f-ddec-5e25-a87e-1218055ac5aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:bf0a13c2-2e58-5ad2-a1cf-11a7b2048e9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:134b2f56-02f3-5190-b125-095f13797f82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3b10bd78-cf10-5983-951a-d6845c4baccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:868e4faf-812f-5860-9250-c3b0e3213012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:4ed84f14-5cda-56e7-8c18-60005af0a40f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:7f61a62b-562d-564b-8add-b313a3d8182d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.7 of @angular/compiler. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c1caf918-19f0-55af-9496-767dffb89d71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8c9d60ff-6019-5228-83b7-9d64762fab6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e6551d4c-e4a9-5d6c-af3a-d070c3e5a937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:af23ef3f-3340-56f3-b4f2-5dd62057473e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.7 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@18.1.2-tuxcare.7" } ] }