{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:175e9b35-032a-51ac-8e60-6eb7b40d492f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2", "version": "17.1.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:64b12fb2-e953-599e-94f3-462ea7a74eed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:3a107ce2-ff8e-587b-ace4-853d7becc0b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:52c95cb7-fd5b-5709-96ce-ac09e579e9c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.2 of @angular/localize, and is fixed in 17.1.0-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:192d6821-667e-544b-b70a-5e8072204202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c85477eb-b70d-514c-8588-5a39caa29aab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:95050a12-1d27-534a-bb7f-52889cbd8a1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:9c5bda4b-f2a1-5ab2-b5cd-30f86d0f5731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f551319a-7f2b-56ad-9014-35fbb6cb93d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:483ccc81-c6eb-5072-b0e1-7d7bf00c7325", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:fbbe48a7-1922-51b8-84db-462ab3d9b3a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:187aaf1f-c630-5f24-8130-04f5cbdad506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:d5a60860-d94e-500e-be27-6bde1c96b245", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:1c1e17bd-6491-57d0-9efa-cf1e87d8f090", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:6475f5a8-5593-5c5a-9234-9bd223427474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:eed2094d-9fc7-5046-bd98-a57689c56c23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.1.0-tuxcare.2 of @angular/localize, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b3eb8ccc-2b30-50d2-9335-f389d307561e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4d1e40f1-ed4d-5bb9-8831-c608e51510ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:56b6fff6-c267-5433-8e34-d29996816b6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2388f5bd-22a1-55a2-8cda-8945800306f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.2 of @angular/localize. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:47039c2c-b7e9-584c-b9f6-181ab2cc5405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:568a0dc7-7f86-5e50-9acd-685d307b3197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4036b9f7-e397-55c4-9f13-8add3b75df16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:9d3b56d6-5e4f-53ce-b65a-158f34083036", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.1.0-tuxcare.2 of @angular/localize, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:54ddf538-bd14-5342-8181-a2ee30b0eb63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.1.0-tuxcare.2 of @angular/localize, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:3dbff612-1448-5a23-a1b6-707ea573c5b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.1.0-tuxcare.2 of @angular/localize, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5862732e-1af9-5e50-be95-8915d7d23933", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.2 of @angular/localize. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ba6e7b7d-42f4-568b-bab1-d0cdb5185eb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ca5258f0-2cda-553d-8d4e-b03a22fd1009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.2 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:4e6e9190-6dbc-556e-8dc9-7328c234ab70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.2 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@17.1.0-tuxcare.2" } ] }