{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4901b245-723f-58df-a7a9-8e72dfd6c481", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4", "type": "library", "name": "@angular/upgrade", "version": "13.3.0-tuxcare.4", "purl": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bb86dec7-9d74-51d6-831f-02b89eb83e1c", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cd341ee8-7085-5806-9258-d6611fc23a97", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f940d919-3771-5c36-8def-144335b6c966", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dbc40f7c-d539-5dc7-b352-f4fb43ed160d", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9e881802-57ef-500e-9dda-eec6cb98a465", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 13.3.0-tuxcare.4 of @angular/upgrade. not_affected \u2014 The target repository (Angular 13.3.0-tuxcare.1) is NOT AFFECTED by CVE-2026-41423. While the target lacks the explicit sanitization that the upstream patch adds, it uses a fundamentally different URL parsing mechanism (Node's url.parse() without base URL) that does not extract hostnames from protocol-relative URLs. The architectural difference prevents the SSRF attack vector from succeeding." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:43f9f3f9-856a-5897-bf88-b3b83eae55c9", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:af1b7bf6-51f5-5850-b3e7-f7b38aee3498", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:817b01ae-a342-5289-8e46-906dd7dd34c3", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f4b80241-687b-5493-992c-ae86eb9e4787", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.0-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular v13.3.0 is not affected by CVE-2026-50170. The vulnerable component (HttpTransferCache) does not exist in this version. The HttpTransferCache feature and automatic HTTP response caching during SSR were introduced in Angular v16+, while this target is v13.3.0-tuxcare.1." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cc477566-c71e-5b01-8595-1819cd1a6a6d", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:764b3109-8793-5649-a988-82566f6fa0f1", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8fa37cc2-5ce2-5243-a7b0-325321741d27", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d533ed14-ec70-5c01-ad43-2eb21b104b33", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1f5e8d8c-a11c-5d24-a32e-0a3ba00d7979", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6b2fb256-4d2a-503d-95bb-069fffd70d71", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fabcaf33-b208-56ed-b369-f26160b39aed", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.0-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54264. The vulnerable method newRequestWithMetadata() does not exist in this version. The AssetGroup class creates new requests with only URLs when fetching assets, never preserving headers. On cross-origin redirects, the code creates a completely new request with no headers, preventing sensitive credential leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9fa0a2cb-4a54-57a8-9edf-f804a7f80ff5", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.0-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54265. The vulnerability is specific to Angular's template/pipeline architecture (introduced in v14+) where TwoWayProperty operations bypass sanitizer resolution. Angular 13.3.0 uses an earlier Ivy architecture without the template/pipeline system, where two-way bindings desugar through the same parsePropertyBinding() function as one-way bindings, rece..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5059312a-75eb-5683-9850-731fcd184583", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.0-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, and version 13.3.0 predates this feature." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0bff2f37-f956-5dea-b8ab-578733a63001", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:573b19c3-74b7-554a-ae44-486e0edcaffa", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:23de61ad-527f-5213-b5ab-ad5ee10464de", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 13.3.0-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular v13.3.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular v16.0.0. The cache-key collision vulnerability requires the HttpTransferCache's sortAndConcatParams() function in transfer_cache.ts, which is absent from v13. Verified by filesystem inspection, git history, and existing patch documentation (CVE-..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2aede753-6259-5eef-82cb-bee18e923438", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:decb74ed-8d0b-54c2-9d6d-c768c02b647a", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 13.3.0-tuxcare.4 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@13.3.0-tuxcare.4" } ] }