{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:955cefcb-7259-5239-86f8-292e7a32ee5c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@18.1.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5", "version": "18.1.2-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:20c815a7-2202-5131-86ce-384798f3fd1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:ef0501e7-ed69-58f3-86e1-9c0f6bd8c1ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:55ed5840-c4d6-5681-8847-8e903646cda5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d9ad8092-3f6d-522d-b3d6-1695ece19d6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:6bbf0fb0-2b7d-58d2-a03a-867e3e675ee4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:376b15e2-7008-5b04-ad5b-d83e72ac7435", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:238f0ffa-9e94-5c8e-a177-229594352b70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4fc15ffd-ddb5-5e43-9af7-b6c8e7eb2307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:07405db4-8718-57b7-8c7d-62999dcecae9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:97eea26c-f26c-5e1e-8d15-a37f5a16b692", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cff7d2a4-7643-5f7e-b207-b8d1e4bfeb79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7cb78e41-de53-512e-bd55-b18802007ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:15a16c83-f00d-51f9-bd61-c1ae2b33e9b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cf140801-16df-5ffe-9374-aad72a2a529b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.5 of @angular/core. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a54864db-7d7b-5d81-801e-b9b9ad2d2d9a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.5 of @angular/core. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:2480ecf2-18e6-505b-8c74-736c0c248f7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d3205ff9-1b40-5819-a467-f3849988d3bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:e2df05ba-c68d-5e9f-ba1a-adf31aa52a8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7a9321d4-0b9c-5d0c-a4d2-29f41c6c4855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:9475c531-5f7c-51fc-8cf9-c15a77fa5f67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d8d5d136-cedf-5d5c-a310-0a3598d2ea20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cbcf1856-406c-566c-a8d6-6ce01518ab3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:abe96bb6-692b-5a62-a68d-3ce0522a949f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:56e5e4a0-a5d8-5e61-98d2-6ba38b1aafb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a719cd69-cab1-5081-a821-f66940b3d37a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c6d9e045-f076-5602-8998-11fd7c2d20a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.5 of @angular/core. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:512e3123-db4f-52c6-9029-8d9d017b9369", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cd940191-cb51-579d-9aee-e5f0daaa59ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.5 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:693baea3-a9aa-5a3d-9fa9-5edd9f391c49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.5 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.5" } ] }