{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:620fe09e-3de0-5da6-ae41-0df1c89c9b48", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7", "version": "18.1.2-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b99b5d7b-a1e3-566b-b630-d84600daf76c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e1864237-b38b-5dde-91f7-110df5ca7429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d0a9b790-6eba-5b2b-b45a-b1478d61c92e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:445435ed-21fd-5d99-b1bf-2016f3abf5bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 18.1.2-tuxcare.7 of @angular/forms, and is fixed in 18.1.2-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:407d5842-6d17-5cab-98d7-366628b8a8ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:4248311f-f478-5878-9f85-a028ba97361a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:82da4f50-2d6b-562f-98aa-f1f1cfaad175", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:caa802d9-2400-550f-a858-64f60447f25a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:63a3ee52-8b70-5ec6-a2a3-ebf4092c8915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:726df61e-befb-5eef-a37e-50f286faa20c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:547168e6-e8f0-503e-b5ea-d6fade8bdcd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a40aa0a3-59db-596f-b69a-471608fb9569", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e1322d70-db1a-5df5-b3ba-4247e1b62daa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:bf43c45d-d6d8-58a0-9e28-912181c23b4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:38babd08-ad42-514f-9ff2-81a3e6e298cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:558293ad-4e27-5f3a-9350-bdf192a2cc18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.7 of @angular/forms. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e670890f-0542-59b6-b05c-c5b4a4f59d4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.7 of @angular/forms. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dfdd5227-ac8f-54da-a67e-fd86e65703a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:2ab6b05f-0a5f-5d3c-9c3d-7d880265aef0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e2573514-2662-58f5-a537-30a19df8a80d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c1fa5b94-273e-5c99-911c-24da8cdd6e61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d23685fe-5b88-5f70-9deb-70ed1d7b16d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:452db9f7-548d-5dcf-ad5f-c58d31f3deb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:2a0d58d1-6175-53d9-b154-b0fc331aa162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:72058502-8b4c-54e8-90dc-5bf321c996a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:74b5cfa5-41b6-5762-9889-98e21fc44896", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d0567ebe-ff4c-5065-8433-5319d2fca8c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6dc055e7-c93e-5a4f-8dfd-4c359bbaf5c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.7 of @angular/forms. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:cff8626a-5323-531c-ae79-7926c29dbeec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:71d94f1b-9612-56e6-a8eb-de65d52e2ea9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:594ff8ff-9079-538e-a856-0f4bae62f526", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a444a8c9-37be-5c94-b16c-00e385764fb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.7 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.7" } ] }