{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1728074b-7c83-5e9d-950d-eab9be9df26f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7", "version": "17.1.0-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c5e97339-cf2b-5df4-b781-fce82bd730b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:65a5d84d-0120-5e15-a9e3-0b9e49856bbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ed1f001d-f47a-58a7-984e-b48590534273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a9ab1421-7fbd-5178-a8f2-91f7edaa971c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.7 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c8ba2688-fd82-5864-b7a2-49d126fa03b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:2d632b77-426b-5e6d-a2ed-8e8043764403", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:051825fe-90cd-5f26-b6e6-d0c84d495fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:894fc7bf-836e-5dd0-a26a-87bdfb6d7370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:82f8df6f-9c1a-5e7a-a6ac-0e92199156ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:9c31b8ce-350c-58c2-ba8a-adcbddc40bd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:10254a09-abe3-5fbd-8d7c-5b200421adec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:e8a4fd57-5f45-560a-af98-dd2a7ac3d048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c083fce9-fcf1-5d88-9fdc-83b0a45d8ebc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:dda08a9e-3445-596a-be82-1bceb59f2d18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cffeace7-d319-5375-8287-8dc4033c87bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:52d7c8bb-e374-5a31-bb34-93c6e91176af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:30595edf-2815-5ae9-85df-cae5b79be0a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ed065e13-9163-5515-bc32-14360b072e41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:27c8d4be-5683-596b-9459-2db1971be4c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ff2e6791-0261-59b3-9093-9d4f0637ccdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:853efddb-77ed-5016-966f-047a477da10c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.7 of @angular/upgrade. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:638c90f8-b43b-5e96-8ab2-0bed4a85f5ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c1d54491-1b27-524f-a2a9-f34d025bd2ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c7ae7688-e5f5-5926-9ac5-9e15264e871c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d7afc943-a034-5c9d-a4f7-86ec01acff13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:3eb12693-7ade-5eb6-a8cf-966515738399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:c056d8cf-65ca-5d47-94fa-c1901d1337cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:16dbcdf6-b3a0-59d8-9831-70d5c0ea6cec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.7 of @angular/upgrade. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0a1cdd22-8c60-5318-96b6-70508ab91bc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:febc3fc2-6b33-59ee-a498-f6042fa5b1eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.7 of @angular/upgrade. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:52d00bd1-5804-5045-a7a0-bc9dea6d790f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:7f81dd2b-adde-5ffe-a902-620bb53c4d8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.7 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.7" } ] }