{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b94e852d-25e1-5e34-b485-ebc558c45390", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2", "version": "17.1.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f72bbe67-99b3-5d76-b424-9d7ba946ba0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8476c357-c2f4-5cbd-b2fb-2d5d113de62d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:43ebdb45-3708-565f-839d-51de0bf7220c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.2 of @angular/compiler, and is fixed in 17.1.0-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:19a34b4e-917f-5f75-b736-6a55bdffa6e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:bb647b01-7109-5eaf-a59b-34b879fba2f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:9003b29a-273f-5ad0-aecd-cc9a31274625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ab9383fc-09a1-51a6-a591-83d27198644d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:1f5a59ff-ba1f-5e0a-ba34-35b191701531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:810e4759-c71f-5abe-87dd-6aebc58562a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b9515d28-a461-595d-932e-9768e58b7cfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:9c2f5606-910a-5599-a74a-59b2469884d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:06d32518-2abc-5c19-b7be-8c6173a4cc02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b066c9aa-f410-56b3-8cb0-22177fb3e45f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5007ffd6-e013-51c9-904c-5c55e607a5ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:10a7cb38-179c-5abf-8e38-9257043dd281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.1.0-tuxcare.2 of @angular/compiler, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:320e960f-2b01-53a1-9fd1-a562d01e2326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7ff28d37-d26a-52fa-96b0-1bc634cac342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ce6dbac2-769c-576a-947f-a636fcabbd7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:31827fe0-5bb5-5342-a2f8-25b60fa47b8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.2 of @angular/compiler. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7d7fe2f4-010a-5143-ac3f-d1fbfa3bfbd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:757746ef-4483-5cf2-8f3e-5e0769c427de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:769bf5f6-bccf-5474-b910-30a5905b5bd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b5a76808-26a8-520c-a034-961593efa61a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.1.0-tuxcare.2 of @angular/compiler, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2895b8e1-7b23-5f6f-901d-24eb0e91a412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.1.0-tuxcare.2 of @angular/compiler, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:52d0019c-36a8-5a60-ac2e-d7f4c1bdb121", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.1.0-tuxcare.2 of @angular/compiler, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7e4f5e0b-9970-5f8e-b8a3-776bdf85533a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.2 of @angular/compiler. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:d848881b-4ca2-511f-b504-2de6bca29729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:775b076a-f609-5c82-b1aa-2157e39b8ccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.2 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:13a78de7-911e-5251-bf4f-9ec4a3a52595", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.2 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@17.1.0-tuxcare.2" } ] }