{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:970b1a04-9eba-5b0a-93ce-60278c2fca14", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2", "version": "17.1.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2b475ec1-f10d-546b-940a-bf1382d2ed53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:1ced8cae-49ab-5905-9404-43ce24468909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:efaddbd6-f5ca-57f9-8e64-3ff990b4541f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli, and is fixed in 17.1.0-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f80d1288-ea7f-5705-be36-e2ced3621a19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5b69aceb-278e-5c8b-bab0-55c15169f7ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c4168b3c-9f35-5759-8dd3-b6ff0fb0f7c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:9e880f0e-8e87-554a-b044-4ecccdbdfe2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:958524d4-6949-59c1-b8e5-1e37946d8148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:fb9ad1b0-94ab-5fc6-bf9a-342923cf5cbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:26f78a2b-3773-51a9-a91b-c34097dc18b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:471a4cd1-35de-51ae-b64d-72056088700b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e497ebbf-481b-5e93-aeb0-3df9c9656c67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:fd255924-5451-5216-8232-8bbc7b0fa3f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7bdb977e-14b2-55f6-b37b-381ac1c3adb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:23462ca1-9481-5b51-b1c6-62a77a8d454b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:182198df-08a3-5582-bcf9-32b1530a39f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:dea45dfe-72bf-50ee-8f9f-99edfa16df17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:34a2c8f9-a139-5ddf-93b5-57b769db9563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:eee3705b-dd15-5e54-93ff-272ac8c00a98", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.2 of @angular/compiler-cli. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:d05694ef-530e-5efd-928a-ff340d2795d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:cbf2abf1-7af0-5084-88ab-50bc3ba4f563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b4eee435-5745-571d-9c2c-a7c74b914f33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b187534b-b09d-5420-86c4-4afb6f0578e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:22edb25e-c881-5ed5-be93-54226f7583a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:323e9df8-5b28-5853-acc8-827216bae33d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4a15b9e3-37f6-52bb-abcd-95ef76bcd4d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.2 of @angular/compiler-cli. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2731a058-d618-54ee-9cbb-22d65199aee9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e393d7ce-91b9-5aa3-9da7-207d5923ac99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:368bd315-61d3-5d91-882f-f348d6a4f2b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.2 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.2" } ] }