{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:69409974-5a32-58f8-9a7a-9650bf6ce2eb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:39a357ea-b615-5868-9844-694f4f5a7921", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fb405444-13b3-5272-a289-6571e3112e83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:af40e5f3-8a02-5ffa-bdaa-54bea6673602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:dd1262c7-923a-5f37-9966-164c1d064851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a040ac64-c095-5749-ac4e-aa91890ab20f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0b1e63db-29fe-5391-84f7-d4b31d6093b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:4cf54731-6e69-59f1-9865-7fb81660351c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:43e385b3-16a9-5d4b-a106-e8418b174a18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ae2c197a-0a17-5620-a770-288530019f89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ee952485-cc59-5ae0-8c74-2a7e495f31ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ed0af2b2-6535-53f1-9d2d-3026df057e81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6e3aae12-4ee2-58bd-aa2b-86b0e8980eec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6c294dc8-013f-539a-83f3-3b9d15267d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:359336ba-fed0-5c07-b1f5-db6d503571fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2e193b13-5315-53f7-a915-53239a193ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f2e074cb-de22-5e78-a55f-bd669254a6cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:79f3c241-d24c-5621-add9-0bcb61abc9d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f8277d4a-777c-525e-a03a-f361bf883460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:56f48626-3a63-5270-aa27-7a09dda8a8d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/platform-browser. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:62155d55-dc63-567a-aa7f-78caa5ed807e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1fc1a383-338a-5d5d-88ea-b2a3d3ae1b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:de79583b-4b6a-5766-9db8-822d82dc9dcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:160ff148-eb35-57ed-865f-fc5e1938b0ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:434a0dd3-1d07-5a14-bdf1-ab52594b5dba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d604f535-c278-5dc8-8f11-13f7249dcc92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ad0ea8f6-fb54-5922-b29c-1e643bc83e11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/platform-browser. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:de3256fb-e7ff-5667-af5a-7a104d6a9fff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3723aedf-c923-5110-80b5-26f146f239dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d4715e80-167e-53d3-9c82-795fcb847c78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.5" } ] }