{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5f82f9f7-f1f1-58bd-b627-08e9ce84ef08", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2", "version": "19.2.21-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0a1db129-1d71-59e0-8a41-9ed8c5a5cad3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.2 of @angular/elements. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5d6bedd2-7909-5760-a85d-dd985e0058e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:83ea058a-416d-5231-83a1-7cd2326a4348", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:13b669b6-b2e6-5149-ad65-37b09fc69320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:40ecb7ba-5034-5335-93b7-4cf6fd8efa48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8f8a5115-495f-5eaf-a2c8-6aabdf91bbe7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:e18de0ed-2f1c-5f72-af95-e2c5ce510b21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:c22392ea-21a5-5e3f-a636-deb1b54f4b4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:7362232a-7c3f-5d85-a8cf-62f3d8881696", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8c783289-2051-5da9-95f2-4193ea737de0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:d6a34a3a-2cc3-533a-bf24-27159c8af0d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8c31b883-981e-5e75-9d4c-d3b3cc26a39e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:4f4a6b14-1791-5418-8dfb-c3b9bb7565b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:72b3e63e-edd5-5973-9553-cdb73aac2c13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:221ab3e3-5c19-5d18-a5a3-1c3a5bea3c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5d342468-bd29-5a0d-9c13-fab2ea05b866", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:f6c67909-4dae-5c84-936b-9526d63f217e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:672452c4-1fee-5719-99c9-39c89187b57f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:3f52fd11-eb48-5e10-8182-615bfedc6234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.21-tuxcare.2 of @angular/elements, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:a495cc7f-4637-52c9-89a4-d7b44010ed06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.2 of @angular/elements. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:bab4f40c-a18f-5836-85f6-0bad2604a236", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.2 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:b665e612-95d9-5f72-9a95-3d83334f3dfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.2 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:32ffa121-3aaa-5d04-9b8c-2c568e905fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.2 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@19.2.21-tuxcare.2" } ] }