{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7f9d51c0-82e9-577a-a2e5-9e672787f4f2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7", "version": "17.1.0-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0c5e8f0d-a8c6-51b1-888f-67a6bc35b5c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:dc81071f-8cd8-5040-9c36-06c0ac60d6f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:31a323e0-2833-5b23-af66-47fe662e189a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3c13307b-69e5-5a11-9f7c-67037674cb3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.7 of @angular/localize, and is fixed in 17.1.0-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1d5fdd4f-1161-5e92-9850-a9007705ea79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ccee5280-4b43-5bee-8946-592cbfe648c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e83f00e6-5d7b-505f-8cca-18a48c63f2dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:9791c243-8769-555c-a6cb-1b943e5b6390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0a16cb68-fff7-5804-a418-112ca603ed82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:66b52210-5ff9-520f-a752-ece54872df53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3d0810c6-d946-59e5-a601-a9b3c6f6cd0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2b770f2d-ed61-5b5c-bb01-cb332cdbfcd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3529b4ea-f514-5850-83f6-30c8d873e969", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3ab5f207-b0f1-5d5d-8446-c2d850387d1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d3da125e-95bb-5b6a-8d42-d4ea0643c94c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:396f7825-9c54-5be9-9a46-636e802fc21b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:70dd7957-54e2-5c36-9bc9-5e5ccb95cfba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:86f0b7eb-9e27-516b-8b77-ef5519a92bda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:1aabcc90-04a1-5a86-af70-96c072ca2231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:469ac488-817e-576e-86d6-368044f8313b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cc53a5be-1d8c-58ce-8e10-1edb6a75d31c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.7 of @angular/localize. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:8e8630c0-50ea-59da-9b77-ab1f002c29e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:f1e025fa-e360-589b-b964-837b98b39247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:241f472d-84c3-5ecc-96d0-78e5f82bac0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4d34bd31-79b9-5202-9b91-66f8b477d62e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3e97167d-3a10-5a47-87e7-0a6974e09853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e81324bd-10b3-591c-bfd9-c2737f1362ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d373d8ca-589a-5289-9859-d8e2c3e692f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.7 of @angular/localize. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:660095b1-f04a-539f-b26d-38fb3319f308", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:421b722e-5bea-50d3-81a4-7478b80954fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.7 of @angular/localize. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:29a76f53-6c0b-5268-9563-9c05cc05ff8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:4e49d9fa-240c-56a0-a44c-fc13c20f2d1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.7 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.7" } ] }