{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:67b2fad9-b0e4-5cda-aac1-03b10439a347", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ccba5485-3b51-584f-a7d6-beba7bcd5d1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:56bca561-67b4-52a5-be4c-80180e5ae42d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1bb9e010-1759-516f-8cb3-912b4bbbdec6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:bdd52beb-518f-544f-b099-6fbba7d6f27d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:bdfb8ff5-2ce6-5650-bbce-02e85753be68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fa1196ac-522b-5471-8bee-eb30c0997731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d2e39c34-2006-5936-9baf-fdca83cf043c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5062972d-6286-5a79-bd2e-f291f40c23ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5afd79cf-d700-5b84-bd85-0818f5c8d2c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:83bbe714-bc4e-576e-bbb4-56c86393089e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ac50cefd-61dd-5a5f-8eb8-1ab0c6c3d9a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2974964d-3911-5b90-a6cc-09e758eae1cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:cae3e2d3-ac4a-58ad-a2e4-b0d3cf5c8fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b752e794-5f89-56da-b010-421d55bb5a2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:62530170-b054-59b7-aab7-c85416955b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:44f39141-7048-58ef-a1dd-36dfe646571b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7c9fc239-4f30-5573-ad12-f6594f84760a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:eb860014-5b99-50fa-bdd7-816e9237ad16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e92b331d-8f6d-51bc-831a-0e2328017fbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/bazel. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8c4e8880-811a-541a-a6e2-90fcd96de907", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:21c6b828-29f4-5fcc-b616-b5e0bc59caf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:62a53da5-07f2-52fe-9c39-d34f739f3675", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:de2ecf64-8a6e-5d51-a068-a1ee71e07cdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b71d7975-d200-512b-b7d7-dc69221efa88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:abdfb4a7-ad14-5ca8-bb3d-1aced9490c4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:df92dea3-d877-50b4-b8fd-14d4439044ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/bazel. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0ed32ee0-fb4d-5a15-851e-df8b94117c8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:46ad50c1-3bce-51a6-8019-c792d960098a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:971771f0-8a6b-5223-93ee-b3b23c937b70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@17.1.0-tuxcare.5" } ] }