{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:819f8cf0-fefb-5d61-ad83-1b818b138415", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1", "version": "17.1.0-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:36c29b50-0899-5ea7-ab15-850d919bdbef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:b3ca447b-64d5-5cd9-b36c-7cf0288f1c88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.1 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:2dae00d4-30cf-5a3b-b29e-1b25d16fff5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.3." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7bc038f8-6b1b-54c1-86d2-b4eceadfd796", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7d32bcff-ce5d-56ce-a811-e602f6416878", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:1c2980a7-5933-5fe6-a007-76c2fbcd05af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:640450f4-be25-58aa-a917-0b82c0767071", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41423 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:0b88ce76-6e27-56ba-8b09-d2b6ccea588d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:380e375f-3dc4-5ec7-94e0-98567ddb8513", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:fd8e4ffb-26a8-51bb-aace-b023cf640a99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:8d3dd92f-21ec-560f-bf02-5869182d80f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:94eedb27-d8a4-5576-8b97-6a0808e8065f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:22f58129-6003-5d40-938b-6d5455142d89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:91d57863-1f1d-5f7b-a8ac-78733b003152", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:077c4bc6-1b52-5389-968e-00180c088ea3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:424b8390-0ad9-556e-9640-df5c50b69190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a1e79be6-6e0f-52df-89c8-1cb5323dc2d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:db98f59e-10f0-5480-a2f7-53bd02185210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:bc63108a-7141-5cfe-81e8-cdda4d3e795c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:d3d7dab2-f8cd-5853-8cbe-eadafa811da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3a9961e9-9fc9-5889-b8f2-2edb815b29c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:b3eaba06-0918-5c1f-8b28-fc8eca97b470", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.2." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:149c65a1-b5e4-5984-85ba-f4f00bfaf8e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:2ba4207f-5211-5a0c-848d-5e07a0a6da86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:81ca0b3d-2632-5986-b4d3-8f82d80735d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.1.0-tuxcare.1 of @angular/upgrade, and is fixed in 17.1.0-tuxcare.4." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:6162f842-567f-571b-954d-1be31d09cf75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:6a929a44-354c-5f14-8abf-0e5a3d89472d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.1 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:d29546ab-7633-5576-afc4-772be3ff20cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.1 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ], "bom-ref": "urn:uuid:11ecc49b-3f3d-54bd-a310-96b81898c1ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.1 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.1" } ] }