{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c851d403-d2d9-5000-a128-ba9e1015f4bd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/service-worker", "purl": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2", "version": "17.1.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b61b45f3-ccb1-5c2f-a72a-c6da5ace1d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f429a6bb-77ec-5ad9-af2e-fe9680f6c82e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:0c4d1fa7-6913-530b-b877-ba9b6b965f8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.2 of @angular/service-worker, and is fixed in 17.1.0-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:9e3ca0c3-69c7-5c70-9751-37e79cb32411", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c1bbeb1e-abbe-5f1d-aedf-115e99a9e38c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c68ad929-df3a-5f60-b023-d2253326f857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:e620bf82-195b-5a47-ac9c-443c485f0b93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:0474f8e6-e169-5ea4-997e-cd2fdf883f27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a0a41184-dc05-5eb9-86aa-0ce1a21f905f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b93fd226-0532-5257-b923-c557860f8067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:281549d5-2387-5232-a506-fb119241113c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:1d9e15ee-bfc5-575b-967c-c21457e844e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c18e4167-8736-571d-b1f3-9f247290f436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:661c10be-2489-550e-a985-37e25127c8c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f91319ed-77c0-5b56-a34f-df3399277e9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.1.0-tuxcare.2 of @angular/service-worker, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:bba6eff9-cd40-5806-8a32-8d5bf9fcdf66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f30ac8bc-cd7d-5b8d-ad9b-6062cc16181e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:70ef4302-86a4-584a-9e74-418108761fcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:78fe195f-f248-5b75-8806-3f303a686552", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.2 of @angular/service-worker. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:35ac7415-797d-52f2-b4df-a247fe5c21d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8e585c62-c74a-50d0-b165-a1f24016a660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:d384766f-c96e-5e9a-a762-b9130b16c0d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:de8893c0-7c5a-5368-be2c-5da6b12d092f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.1.0-tuxcare.2 of @angular/service-worker, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ab87b9b5-f42f-5feb-859a-30041e9a8db1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.1.0-tuxcare.2 of @angular/service-worker, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8ebf3a04-b0c5-5f55-8d9a-6d546f72ec73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.1.0-tuxcare.2 of @angular/service-worker, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f4c28da0-39fb-520e-8d29-8c17db997f9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.2 of @angular/service-worker. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b8032ba5-e4d2-51a8-87a2-46e91e1e498c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:0bd250e8-fd09-5a6b-88a7-bfe27868bccf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.2 of @angular/service-worker." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:c5a50784-ca1a-545d-b373-ff6abf1d9c09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.2 of @angular/service-worker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@17.1.0-tuxcare.2" } ] }