{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f2a22c2e-3981-5276-86f3-5f28b6d4edf5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@18.1.2-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3", "version": "18.1.2-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:1227b0f3-c805-5f77-995e-cc20b1553a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:8fe6bae4-c245-5411-ad52-fbaedd0452b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:31f80c39-a5f9-5920-b666-4d2970a68ed9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:41a7c4a5-432c-5f07-a841-2019b06795c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:7b1b3782-be80-5e29-aa97-4ba9893a2868", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:553a42b6-200c-51df-8f22-9701bb376030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:afb5a9db-49b6-51a5-8402-09c179683ecf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:e9fe1b44-9d38-50b6-9423-328a77041ca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:0300d791-f3f9-5289-b806-a5eb881bcd56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:14177bf1-d60c-5172-aca5-31e1abcfbf03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:3b97d08c-0dcf-51dc-b97b-11572e850a9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:c27d2f4a-ce26-5797-98d6-f36ff1cbb1a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:5e47da70-29f2-5980-af7e-32fdf664bbdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:eb21bd0d-4930-5a71-892f-d0acb49d633a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.3 of @angular/core. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:0091c64f-331a-59ea-8d8e-83de34a5a4a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.3 of @angular/core. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:4322e64d-fa0a-538e-b28d-b6862cb0946c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:ee04ff99-bde6-5ff4-8a92-131d39135b55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:54e93a3e-ea3e-5d49-9011-c5206a702a90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:502bc7e0-3a29-52ad-855f-45844cf1bef4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:d5a82511-351d-5781-8c3c-596a11474ea7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:221a9cde-ce87-5132-be5f-7f91aaaf7a6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:d729c23e-2ce1-51f4-a939-b99cae3831da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:6c7ffe91-da2b-5363-817d-123bd049a25e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 18.1.2-tuxcare.3 of @angular/core, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:65950089-2b6a-5a98-a7c0-23c21f544bae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 18.1.2-tuxcare.3 of @angular/core, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:61ff2fdb-5582-5d68-a638-a5ad14c7ee3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 18.1.2-tuxcare.3 of @angular/core, and is fixed in 18.1.2-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:db23ebab-971d-5804-8dc1-c1eaef8e8405", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.3 of @angular/core. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:41fe8831-fa5a-5c9c-803b-ffd2eae46d3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:9dc02232-6fc3-55e9-986b-4a35ce6e210e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ], "bom-ref": "urn:uuid:17b527a9-ab11-5b09-822a-039e472afc60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.3 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@18.1.2-tuxcare.3" } ] }