{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c9f0961-e5f6-5a7a-816f-5c7a15b4c728", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4", "type": "library", "name": "@angular/upgrade", "version": "11.2.11-tuxcare.4", "purl": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c766ea09-f62f-517c-8dae-7f2110584f0d", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:621afec2-13fa-5753-9131-220dcbfec490", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d58697b1-5ba7-50d4-8794-8bd1bee0ae5d", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a69a1303-23de-5af7-a9f1-12f69dfeb3f5", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a4e6afbe-32d7-5f86-8dd2-dd2c1e451953", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:99ab8295-2704-5850-97d8-81c4f17d73fb", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d71bcb63-dae9-5d0c-875d-f0b33d9461f9", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f7512723-da43-51c6-9d4b-52b632822ad6", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:45811f71-5503-5d99-b666-17e9fc6fe23b", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 11.2.11-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular v11.2.11 is NOT AFFECTED by CVE-2026-50170. The vulnerability affects the HTTP transfer cache feature introduced in Angular v16+, which automatically caches HTTP responses during SSR and replays them during client hydration. This feature does not exist in v11.2.11. The target lacks the entire transfer_cache.ts module, withHttpTransferCache API, transferCacheInterceptorFn, and client hyd..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7468de06-98cd-5c60-afc3-55a68a43f0a1", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c807440-995d-541e-94d7-ec487e67575a", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3da87f03-b91c-5eb7-80db-ce9287e8a1e4", "id": "CVE-2026-50555", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 11.2.11-tuxcare.4 of @angular/upgrade. already_fixed \u2014 CVE-2026-50555 has already been fixed in the target repository. The fix is implemented in tools/postinstall-patches.js (lines 96-139) which patches the domino dependency during installation. The fix adds NOSCRIPT to hasRawContent, removes _scripting_enabled conditionals, and implements escapeMatchingClosingTag to prevent XSS via raw-text element breakout." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:843c121e-a40a-59ff-8892-aee2d7fb13c4", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14d46d82-85ba-583f-b7e6-ac5cdc6974d1", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:97b600bb-d0e4-5b7f-a6b9-e2a3aa9c264a", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:91ec5379-ecbc-534d-a8c3-785e7597e06e", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 11.2.11-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 11.2.11-tuxcare.2 is NOT AFFECTED by CVE-2026-54264. The service worker in this version does not forward request headers during asset reconstruction, eliminating the cross-origin credential leak vulnerability. The vulnerable method `newRequestWithMetadata` that copies headers from the original request does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c57378c3-87a4-5bf5-9049-e613aaea2765", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 11.2.11-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 11.2.11 is not affected by CVE-2026-54265. The vulnerability targets the new Ivy compiler's TwoWayProperty operation in the template compilation pipeline, which does not exist in Angular 11.2.11. In this version, two-way bindings desugar through the same sanitization-aware parsePropertyBinding code path as one-way bindings, ensuring security-sensitive properties are properly sanitized." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9eff8eb2-20ea-548b-a6a7-9043dc4ac889", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 11.2.11-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular version 11.2.11 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation does not exist in this version. This feature was introduced in Angular v16, and version 11.2.11 predates it entirely." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1f1e8620-4845-5ee4-ad94-562e4df8807a", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:286cc318-e12a-54b2-9cb0-0bd9b44a21ff", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14f04897-aa0a-59bd-963c-7a380a88b9d9", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 11.2.11-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 11.2.11 does not have the HttpTransferCache feature. The vulnerability CVE-2026-68945 affects HttpTransferCache, which was introduced in Angular 16.0.0 (March 2023), approximately 2 years after Angular 11.2.11 was released. The file packages/common/http/src/transfer_cache.ts does not exist in the target version. Angular 11 has a generic TransferState feature for manual state transfer bu..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:51eac9a5-c57c-518c-a21d-550316f18fce", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4bfb7e47-4cad-5752-ac79-04ef217a613f", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 11.2.11-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@11.2.11-tuxcare.4" } ] }