{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:53765edb-d0d4-5c2d-8d68-e62ce76ea094", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1", "version": "17.3.12-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:23c1772a-e7c7-5991-b742-9025d1a57b6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:e67173aa-6d8a-5109-b53a-a98711464792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8ebe5d63-f2ea-5aae-b0ea-3f67084eac6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:5e11ba02-113d-53cd-9cfc-9ec7e927b939", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:ca114f46-e4cc-567d-b566-6532d4ebcc2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:e0304146-cce5-5922-bf48-c79b5f94a68e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8bcb3ac4-c932-5b5c-be63-163b972957c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3b24813f-26bf-553c-ad81-2169607e7dde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:68ebfe3e-45fd-51f4-a7f7-16da52f4abbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:44596eca-b1c0-5678-b0b6-d997f9988f0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:ed7b7e20-086d-5a15-ace8-a7c7939f060f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:97710bf6-174b-5f6c-9552-0c4cdd01885e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:941a6a47-7edb-56f8-8909-316de3f77cf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:96ac77a9-9c07-5655-96fb-55b0d47914d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:7c8d1a3f-2e42-592e-a3c3-c92c48864412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:dc2179fd-44e5-5482-ad62-fb60c4ed614c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:39b8223c-063d-5f7d-88ff-ec5c6be8ca33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:aa0f4441-9736-5d8d-bb3d-ac8a537350a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:a550632a-c85e-56ec-8f8d-1d0a85020750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:80a7e774-5613-5262-989e-3ab86b5c5b63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:fcaec8dd-06bf-5391-98a1-c6f39b483b8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:9adfffaf-1b16-583e-885a-66fe89568eb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:94785476-87a6-54d8-b55e-a17141d2e0cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3e6521bf-35c0-5ddb-a498-8f08b18086c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.1 of @angular/compiler, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:88609f95-a339-555a-b40e-743ce5745ece", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.1 of @angular/compiler. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8ff7fefa-7b64-5b70-ae06-52f713563924", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.1 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:215f038a-2418-5cd4-8f6f-6f48356c9abf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.1 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:75180941-e00d-5157-92b2-10e6803342a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.1 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.1" } ] }