{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:62aa90de-8682-59a8-b29a-220022ec1a19", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2", "version": "18.1.2-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a43f1fd1-dbdc-5f45-848b-c9644ab2d722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:495e298c-fc2d-56a6-8d06-9519835cc754", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a9aec17d-118e-5c2e-8350-8d8881723729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 18.1.2-tuxcare.2 of @angular/bazel, and is fixed in 18.1.2-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:e6c42020-d439-5c4e-9dde-468848b2afb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:fa90c604-1646-57df-a0a1-00e069288ed8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d356c22f-a8ce-5d76-8aac-faca780d9b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f178a203-0a53-53bd-8c61-b7070f6e98b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f9d6b154-9af1-532f-bf51-d02451bd682a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:41c4ed7b-e60d-52fb-8bcb-7daf7beab249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:6414277e-36eb-57c0-8656-5c49cf59aeaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:1f6bd60f-57a6-549a-ab2a-63a9cbce4c7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c174c53c-41c0-5ebf-bba1-e9ced14d2022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4671b4b7-2a2a-5a2d-b2c9-db7f069dba98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:3c4b6cd0-7214-5666-bfde-73fbb655a7d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.2 of @angular/bazel. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:edab88b3-93f9-5df6-b2f7-4264df1af693", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.2 of @angular/bazel. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:55460565-7f7b-5195-903b-3717629fc343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:2e70d8a0-9a4d-5733-9af5-efe015b56dce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:febcc778-9c85-5c4b-9fce-248a4c090334", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:5d72c49b-666b-5615-9847-5709b6efb5bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:da2315ae-8f05-5ae3-b1fd-97f533a35b91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:2e9fabda-2318-5623-97cb-c6f37e4110c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:1cc47fd4-118c-56be-89d5-cac4108ed486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:45a101b0-d77c-5aaa-8bdf-39ac7c741c5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 18.1.2-tuxcare.2 of @angular/bazel, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d85c7c22-1160-5e7d-ba6a-4a3f169932e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 18.1.2-tuxcare.2 of @angular/bazel, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:e3e670e1-961d-5905-80d8-7f4b9a0e4c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 18.1.2-tuxcare.2 of @angular/bazel, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:aab44d22-acd9-5ae3-bcd6-b6be6a9f2bae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.2 of @angular/bazel. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f89c7b89-a69f-53ca-bd12-ddc3d6de046e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:829b4ebb-7a93-5bc1-8566-23baac5ca418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.2 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ], "bom-ref": "urn:uuid:995bc909-6bc7-59de-9250-8c7fc0101a7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.2 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.2" } ] }