{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4e9b0993-74f6-5303-83a3-2de517076991", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8", "version": "19.2.21-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:2301f01d-b8c7-5648-960f-eb5a5c4f7991", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.21-tuxcare.8 of @angular/elements, and is fixed in 19.2.21-tuxcare.9." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:df49044e-a20e-5aef-a8b3-ffeb93342d61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:981e7260-f8c6-54ac-b023-37b9b8690f33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.8 of @angular/elements. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:a162e55c-eff1-5cc3-a670-5f7e699d5e90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:7fa13b9f-c207-534e-869a-28e5f9fc9a6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:893a75cd-8c2a-5df6-b7b2-4a62e9860acb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5eeab652-edd6-5552-9b43-5c5702ee2271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:18a1ac69-e411-5f3f-8365-b513b68558ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:da8529e7-07bf-5afe-bef5-28eecf66ba73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:d9ab343b-9de1-575f-a9f3-576e6f64ec12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:72bbf2ac-197c-55f6-a085-294340650c4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:c26afaab-20c6-58f1-a96c-8e01326d7e12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:6f320c04-9cd6-55fd-b874-8f40e8aaec95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:4b71b83e-8f27-5a5e-8fcd-e3fe0bd1d571", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:37146934-181c-5df0-9440-8aef4b40fa15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:1d4ed022-a2c2-5005-a052-169a3f85bca0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:027b13a4-1d92-56b5-814f-7bcfd4976db6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:9da08dfe-7c1c-531f-a4f9-3e10f1ee56ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:7cf9a9c4-9a60-5ea8-8db0-22b123ac9665", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:5ca3177e-d8cd-5f3c-90b9-f17bc2fffb08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:8d28b4e7-c24b-5af6-b808-b5af85d4d0f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:007247fd-2cf0-566f-9aba-4dbbb06c5d56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.8 of @angular/elements. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:8048ba06-1293-5cf4-b095-ce6dafa27f9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:dd6ca93a-4655-50e2-9e0d-e6d41fdadfdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:2436da7d-6be8-5833-ae42-4c76e58233cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ], "bom-ref": "urn:uuid:b17d7b35-d343-5396-8aee-f7ae421a1ed3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 19.2.21-tuxcare.8 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.8" } ] }