{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9972b3d5-0e69-566e-a5b5-7531c7bcba0e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:07d58335-fcac-5177-9f44-767a67c83762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8a25eac0-1bdb-5163-8569-64e848332be9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6cf66bbe-ed6d-5c67-aa53-f3288d06ec55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9f703c48-8bd5-537f-880c-67fbda98cd93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:4de5e2a8-afe9-50ae-838f-d3adb3f32359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2c828864-1fe5-5b2a-9629-891d15ab5845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:89d1fff6-2cd7-520a-9e7a-0d8a85b4bb94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2f7b6ad1-cf6f-5ea0-ba79-ebd479b96500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:947f6796-ed01-5314-a2a0-172a0ea273b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:12f82d4c-b422-5dc4-b8d2-fae6759bda68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d1ea226c-0079-500e-b63b-8716c1350f5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5692f259-84e0-539e-a61d-ac17688e680b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0183e97a-7c02-5f60-a0b1-e9827c4cb5a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5f0259eb-0bd4-5cae-979c-de86ee876539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:dd62258c-3fa8-510a-8949-624f612fa009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a4bd6700-3496-522f-947c-893d3701f281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0d9618ee-36cf-5900-8793-f164859dcb4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:36ad35f6-8d25-5e64-b9f6-09e4a88b83ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5cfe33ce-7f02-50f4-b059-731f80c9b00a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/compiler. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:db2dc82d-371a-5998-b7e9-ad9d55882b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:081dd58f-2af8-59ea-ae66-f2e8c9cc0757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:869e10e3-36f0-51fd-973d-0868f24cbef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e02d8692-ec50-5dc1-8e15-44dc6482810a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:afbe4563-7f38-5e6b-a049-2e91b24e8897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0c6197ff-fe0c-5b61-b4ba-d541093ed3ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e778af2f-d919-54c0-9390-9e3bbb153eae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/compiler. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fe36fc44-650f-599f-8aaa-eb731247461a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b1131d24-73c1-5987-ab81-b1706e3be0c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:62257e7f-eee7-504d-b26f-8651db9c2b9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.5" } ] }