{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:723d4faa-8b78-57e1-be1d-62836c74c00b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7", "version": "18.1.2-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:56ba3a6d-2c4f-54c9-8fd6-c7f565c4e3a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:183e2115-fe55-5e3e-8d7f-188b4a827a01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:96b55716-ee70-5e0c-aace-1d8cddeb12d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:558c1bde-4c92-508b-a566-1cebc7a697a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 18.1.2-tuxcare.7 of @angular/localize, and is fixed in 18.1.2-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a4f3d8ae-047a-5f9e-b0d4-3484f0c26752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:68495786-2eb0-59c0-8024-12416dcd94a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dabc2599-cedd-5289-b264-549743ca525f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:1b9882f5-a69e-5475-8f90-5e4787010293", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a23b78a9-3f0d-5e2a-8c5e-fb4db1515843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:7f9d5c25-1552-5ded-bedc-4b3247a71f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b4574427-0823-57ad-83af-5cec460acd4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9614d2d9-16e0-51d8-a2cc-9bbd349db1a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:31f6446b-e415-5dce-9f5b-170682ebb7a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6a9da25b-17b3-50b1-bb50-3def5207c4d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b073ab14-760a-5f49-9b78-db5d14d6977d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0ff783e7-e001-5c22-863d-50136cc22c2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.7 of @angular/localize. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:56c125ce-bd6f-510e-8a2c-e77afcd13464", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.7 of @angular/localize. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3aeb59d1-e3cb-5008-ae3a-990ec80d407b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:ecf3a54b-0a86-577e-9584-57af46025453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:cf5bc0b2-c257-5713-9b60-555f91db67ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b6de6702-13c9-5876-a022-91dd1bc74085", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:618fad48-0011-53ee-b4e6-d4a1c847aeb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e687c347-d04b-5c6c-86f9-bc1fb80027fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9d039252-742d-50ff-95f3-4edf7b9b40b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0bc7fc76-70c8-5951-b634-c05ee981ae63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:226b9c8f-b90a-5c63-b49c-1dfc5395b609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e6d37b57-57af-503c-ba76-a3774a9f2485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:4ce404b0-4235-55a1-a5c1-e59bc1524f71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.7 of @angular/localize. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:57346645-2d6f-54a1-ad74-3d6340f5f54d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f857f8ad-d39f-5762-bd28-64d3331ccee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:12e4ce06-b3d0-5499-8bb1-7575999935b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:7558ebd6-5b31-5f36-99b1-dc6907ebac64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.7 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@18.1.2-tuxcare.7" } ] }