{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:67eff865-a264-5e20-b2aa-cdad36c1757e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7", "version": "18.1.2-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:564bf0bf-1fcb-59c1-8973-b91454e1713b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8ed931fa-8daa-5248-a543-d8aa3ea888e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:109c2ccd-92bd-52d2-af32-32d1129af405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8f100e95-8adf-53c8-8b22-30b71721c972", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 18.1.2-tuxcare.7 of @angular/upgrade, and is fixed in 18.1.2-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:232f7a7b-cbc6-5ad1-81c4-9252a4617e8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b9cded6c-95ec-5a16-941c-4176db4cb7ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a0e9273a-64e7-57a6-83c5-c1faeba98b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:778a71b7-31ae-522f-8e14-d67c0b21729b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:98d37db1-50b7-5cd5-9f36-a453af93871f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3ec10b19-b932-51dd-94f0-e3b9622e83f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0220b72f-b54a-575e-9550-c80c4a91b2fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a73eeafb-fff4-598c-8707-70eb7bae5920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0a8ee442-39e2-549f-a403-062905cbc5ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:5423a87d-0900-5462-a8aa-c1c4ccea3298", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f0e343a9-9cfd-50d7-af0a-27c77b524004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:888ea453-4416-580e-81f1-383568f22f65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.7 of @angular/upgrade. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:68912761-1c1a-5333-849a-e23c4a70568d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.7 of @angular/upgrade. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:76aa0bd2-69ae-506f-b943-876bde6bfaa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:2ccf8768-dfaa-52d9-b443-a5a2e9979d66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9ae4dc58-c3e9-5338-9711-5c9bb1e2e0da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6ce0dc45-fa65-523c-a24e-af33f6090be0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:39f2bf86-2dae-5168-a886-86a0865a65e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f8743f9a-e14c-5cde-9167-cc3d25550179", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d5a16f23-78f6-582b-ba13-7078c9905156", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8d3e3ed1-6c4c-5836-8229-e833e16999b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a595dbb8-89bf-57d7-8f70-6b92494ca09c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6ec8071f-48bf-5706-b5d3-24a53ff7c0fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:33d3798d-408d-559f-b449-a739f1b7b904", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.7 of @angular/upgrade. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9c2b28b1-8069-5f95-8d4d-d812be2ae73f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:329adc92-4f43-5e84-82c2-4e49deec53ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:504eb75a-b588-56a4-86a1-e5c2257f9e21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a691b73c-3b91-57dd-9c11-336c6339fbe2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.7 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.7" } ] }