{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4274f346-b863-5f2f-847c-9c6e92600e1c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8", "version": "18.1.2-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d84d493a-79a6-5371-a74a-ce24c5f42dbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:19764e37-96b2-5ac5-99ee-a42721a92b26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3f153acc-a10d-5388-9963-95e82a73e3f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:0ebbf91e-a49c-50c0-b2dc-1db66ba8f90c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:9a8f959b-3e3f-5477-8e13-703e031cc8aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:dff4a6bc-5f9b-5525-9a28-d7f691189973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f253674a-29de-5753-8459-42aa5839da14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:62a4e40b-4001-56e1-881e-6070db2cc762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a14d32de-a432-571c-a9db-451451f4c51a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ed21c673-abf2-550e-b0b9-83534ebef139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1036d027-ae0e-5ee0-b8d2-b17a4ba04ad8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:fa2dda0c-32f6-526e-9f0c-277fa42351a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:462f8905-060a-5cd5-b9e4-c7d38d0546ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:641bbce4-27d7-53e3-977d-873a6828d14b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:919ffeda-a667-5974-8f01-3a1a887895c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:51bc8d7d-189e-5c7f-8a8e-da9c8a450df2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.8 of @angular/upgrade. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:dca11624-bec1-5794-b244-4c330165e115", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.8 of @angular/upgrade. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:34ea8135-1787-5606-9f48-47b3ea7761c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ea6c6df4-ce32-56b5-a375-dd54cb6f8b48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:39fb4991-a313-552b-a909-13bb8c6e41ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a3d6305d-74e3-5cec-bcac-10dc0218207a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b5170a0c-aba3-5a33-bc09-65bb9070f868", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:c272abb6-43e5-56b9-9f1f-3fadd73534c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:c6993c24-5952-56f7-9046-ad66a51d4182", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:888467e9-a68e-5f40-a1ec-979fa251e5ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:59aeca38-72c3-57d8-8a72-109b9c40b814", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:c204f393-c211-53b9-8aff-7aff6f614913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f1b63f6e-94a9-5998-b3f0-0e101f231dc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.8 of @angular/upgrade. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:953501ee-0df1-56b8-a6de-14868e3bf35f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:f2bc802c-dcb1-5979-bc87-21b4e355e1a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:23dc8207-24b7-5b34-8230-f49a192c2288", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:356f3ddb-30d8-5f2b-b104-8ef93c3b7fda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.8 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.8" } ] }