{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f2d5cd62-e16c-503e-af95-526aaaeeb0a1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5", "version": "18.1.2-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3184ab80-b371-5865-a9a9-82db9e9b09b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cc37afc2-b389-55cd-add8-8848999061da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0460fe41-aec7-54fe-b323-5198e86ead8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0e22b668-9057-52dc-bd15-44a2d52f5a27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:2efbbedd-0e81-52e9-8e98-8ae60923b743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:de14ee26-ca4b-5c0a-91b3-867be7522fe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4393fd76-eef3-5f30-a532-24f1fff22fbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a7c11dc3-2cd5-587d-a1db-2fc327586a5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3a5ba089-0ee3-543f-875e-90c5ae42cebb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:32ec6582-5a52-5203-b7b2-b7af38eab5f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a58c83fa-4be1-5f7e-8d9f-82a9c0f04d6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:e18d41d3-7fdd-5afa-85c7-d816f040d177", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:aa91cd9b-f270-521e-92c5-f7bc39f6e07e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:8defa53f-f020-5a8a-859a-734233354b8e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.5 of @angular/forms. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:472e846b-2d9c-5e6b-8ca7-0cda87b96a1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.5 of @angular/forms. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0f289d3d-3caf-57dc-a288-eed08e1297f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:a6203a01-0971-534d-add5-b23ecb09c0f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:492d0834-233d-539c-88c3-5ff8516f700e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:efacd723-d232-5663-84a7-2cd442226e03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:685c5f10-23e5-5499-a558-96ccc0e5bda3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:e941a03c-f9b9-55d4-9afd-5ffe6a19eeb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:9d4375f2-03f2-50a2-aa94-47c30b81a024", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:580e4666-edc1-5543-8245-5c221c8b7bab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c31f8739-17d6-513e-bd75-7c21f9a36c1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3b749db4-f0dc-55a3-a7a6-af66685264c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d8f606c2-f35a-509c-accc-f82bed907414", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.5 of @angular/forms. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:161b3874-3ddd-5fc1-ae80-76c2d3680492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4882ffd7-bc2b-5629-b64b-5fcd298e4f53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:96725227-f0c3-5be1-97a3-073a49b3e8d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.5 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@18.1.2-tuxcare.5" } ] }