{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:68545a02-e120-5993-a14d-84c6f25b72b3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1", "version": "18.1.2-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:4570565a-e11e-5ca7-9a3a-228cf7ee26a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.1 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:11d7d440-418f-5ef1-813f-0f849421213c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.1 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:2e2d5907-8ad1-5808-bb9b-44c8798926ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:82a7d214-b02e-5504-b5b4-d4220b27a59d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:da29f01a-fb5f-52dc-b04a-c984c704d381", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:bdc458bd-0bf3-5fa4-acfe-dd7943d6634d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:0e425b6d-9217-5170-b9e6-909a85cf9765", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41423 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:45b56cf9-cca4-57fd-84a3-bb834eac89eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:d73d8c50-8796-5446-8417-9314eba8bf6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:c45b1aa0-3ef0-5bc8-9250-996bba429281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:226bd8d5-6bd6-5d1f-9ca0-a43ddc28e0ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:0b75edf9-e9b6-502b-b392-8a9b47e22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:40d74512-08f0-5242-9804-b8a30ae1004f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:9ddecc93-68c3-54cf-b559-78ec3b9d2b12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.1 of @angular/bazel. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:cda8fb89-7f80-5dc9-aa8d-b905810b7298", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.1 of @angular/bazel. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:dd7d467c-446b-56b1-8c03-51000638a6c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:2fc380cc-dab9-582b-bfdf-253525f3e014", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:8f5308a1-e58d-58d4-862f-24b13e801800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:dd08a951-a272-5381-81ca-da3125cb4e62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:1fc4d1d0-2155-5bae-84ff-8efd90d3074c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:e3fe2b6a-2b84-5daa-980e-d74959e3cc29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:42aeaec1-49e0-5c85-85ab-df919de9ef43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.2." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:9f6679e1-09f4-5f80-b1ab-2d82f77d2c1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:02706b59-aba3-5187-bbac-1ec09a1611e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:c3d64c68-3ae3-5145-b589-03e9b217106f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 18.1.2-tuxcare.1 of @angular/bazel, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:5871d3a6-4ee0-52bc-a846-1279cf064a82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.1 of @angular/bazel. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:7180dcc8-bc43-5692-bb2f-6b7783604720", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.1 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:193f3263-6876-5e55-a098-52d25141624a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.1 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ], "bom-ref": "urn:uuid:dfba1374-20df-568c-8a5c-006add761c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.1 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.1" } ] }