{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c700d66-46f0-5396-a72c-8aa10152172d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1", "type": "library", "name": "@angular/elements", "version": "8.0.0-tuxcare.1", "purl": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5fa6d315-a472-5ab9-a382-a04527072ae7", "id": "CVE-2021-4231", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e6d15d63-557b-5bec-a768-466569bdd46a", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7fd9aa74-899d-5b1a-8dc8-fb70e48fadd5", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:18563dcc-bb1c-5601-9997-e3e728dcfec4", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d21f56b0-08a5-5d0a-9fbf-a95912bff972", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5d3ebda6-b81b-5bf1-b36c-0e3ba371345c", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.0-tuxcare.1 of @angular/elements. not_affected \u2014 The target Angular 8.0.0 is not affected by CVE-2026-41423. The vulnerability exists only in newer Angular versions (17+) that use the WHATWG URL API. The target uses Node.js url.parse() which does not interpret protocol-relative URLs (//evil.com) as hostname overrides when used without a base URL parameter." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b8fd5609-5dba-5386-ba7e-2ce8449d0dba", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bb885496-54da-5752-9876-11c7f4c7ec29", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e77b1de9-0a20-5afe-b167-3527abce37f7", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:df7f62a8-9d2c-5add-831d-6ce1e5e9efc1", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.0-tuxcare.1 of @angular/elements. not_affected \u2014 Angular v8.0.0 is not affected by CVE-2026-50170. The vulnerability requires the HTTP TransferCache feature (automatic caching of HTTP responses during SSR with client hydration), which was introduced in Angular v16+. Version 8.0.0 lacks the vulnerable code path entirely: no transfer_cache.ts, no transferCacheInterceptorFn, no shouldCacheRequest() function, and no automatic HTTP response cachin..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8ecbf12f-09ee-5629-869d-7c6ecb8a92ba", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5823ea91-9d7c-56a6-9370-db2df769c677", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e8e1d895-b325-5673-a81c-1f95aa5c53a4", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a2ea3dca-6ef8-5dc1-9332-cd3f31b0c017", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:402282b8-a752-5236-a0ac-2f3c9ed561de", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f0ec94e-181e-58b5-83e2-729bc29cf812", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5bae499d-4a99-5040-a8d1-6880a1380d4d", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.0-tuxcare.1 of @angular/elements. not_affected \u2014 Target version 8.0.0-tuxcare.2 is NOT AFFECTED by CVE-2026-54264. The Service Worker implementation strips ALL request headers (including Authorization, Proxy-Authorization, and Cookie) when reconstructing network requests for asset fetches. This architectural design prevents sensitive headers from being forwarded to any destination, including cross-origin redirect targets." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d3c93480-e583-5bdb-8433-51363c962c53", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 8.0.0-tuxcare.1 of @angular/elements. not_affected \u2014 Angular 8.0.0-tuxcare.2 is NOT affected by CVE-2026-54265. This vulnerability is specific to the Ivy template compiler pipeline introduced in Angular 9+. Angular 8.0.0 uses View Engine, which desugars two-way bindings through the same parsePropertyBinding() code path as one-way bindings, inherently applying schema-derived sanitization. The vulnerable TwoWayProperty operation and resolve_sanitiz..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:103757b8-e4ad-5115-808b-28598d99f7ec", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.0-tuxcare.1 of @angular/elements. not_affected \u2014 Angular 8.0.0 does not contain the vulnerable HttpTransferCache feature. The CVE-2026-54266 vulnerability affects HttpTransferCache, which was introduced in Angular 9+. While this version has the underlying TransferState mechanism, it lacks the automatic HTTP request caching feature with the vulnerable DJB2 hash-based cache key generation." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f916ae5-dc57-5531-bdfd-1945a4e0ebbc", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cf210f87-9e50-530f-b1eb-4f6b1122e35d", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.0.0-tuxcare.1 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@8.0.0-tuxcare.1" } ] }