{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:46621132-ab66-56d0-9521-eef9ffb47796", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8", "version": "18.1.2-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:60c7e2e4-765f-5fa2-8c09-5ea6ee011ee0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:190f51dd-6bea-5d63-9f30-2de8c6bb7322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2544fbb2-20b9-595f-9d5a-c73a5aa39104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:61cdfbcc-5c64-5391-84dd-ab473ca169b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:96dffc0d-a065-524a-be6c-0df3243059f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d1c2dd64-8757-5b11-91f4-07691012e8c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2c662562-d7e8-509a-963c-f0781f6ee738", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:785d9d4c-9380-5d88-aeee-aae1567aeb1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:9a88803d-38fc-5d00-9558-c01e6d18d79f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:be9fcae2-f8eb-508b-b437-686243821f39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:51471e9a-7309-506f-8a44-d3330ec8fcfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:6d1dac98-243d-5859-b573-e3db8500eaf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d371253a-093d-5b4a-b267-13b84afb37a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:7596a154-2259-5ccf-8b0a-f1e344ffb7f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:63a7d300-2564-55fc-b22c-59917c784e5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:409e6ce5-552c-5664-8cbc-ad21c19c3e43", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.8 of @angular/forms. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d5b875f4-d198-5fb8-b5b7-88466c156e67", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.8 of @angular/forms. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:6706ed7c-bc36-5304-b225-3e0ba473cc67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b9d2350c-9b86-5d01-a9e5-a66115db3857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1f92f87c-fb68-5658-bf05-adc739f8e145", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:22975f40-51d8-5502-b6d1-85fae16c2546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:c51c6c7b-286f-5ff0-b08e-f5196be11cbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:5bee5ad9-06c9-5201-a799-f09f878fbfd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ac8fef97-1d03-53e6-b17b-104ce51cf930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:6de2944d-c38b-5fa5-87f0-5ced5b5b5c8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d9e664dd-d21e-5cb9-bfcf-725f98589b04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2a141426-c1b8-5f12-b2ce-7d6bceaf278f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:35b5af1b-a111-588b-9fdf-d6d63c983e00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.8 of @angular/forms. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:62dfd8f0-3a21-5f42-a70a-60b31e9a3fec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2d20f22b-fce4-5876-8b41-9054b2c3d56b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3059634a-7b2e-539d-befe-cca450ec466c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:0f7f4edb-c8c9-5f5f-b507-baeb60c8d6a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.8 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.8" } ] }