{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d43411e-02d0-5074-a51b-9c32906b72a7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f0762a49-bf84-5d61-9fbe-1b8a636eb469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a7218dbc-1525-5801-92f7-5fa0a47bef1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:da36fc11-1b28-5237-81b3-662b05b02e97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:db463ed1-ea38-51a3-9ad7-e5e27de6fce8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:52a92820-a430-584c-95d1-76441d587dff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:44064e0c-71df-5a5a-ab9e-75a4ccec5934", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1b5f6cb4-7125-54ea-80b5-c3b74fd06da2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ceaeb581-b982-5efe-ada4-193101167256", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7c0102d5-8199-55f9-90e6-d6fbf844d7cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6a11955d-ac4e-52c5-9c75-7fe20e38a8f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b68f0ce1-b61a-5dcc-8dee-22d0ef09ffae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d79522dd-f8c8-52df-9b0c-f65e983373a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:94a01f8a-a205-5f28-9cd5-f6b3cd2ff9db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:439bcb01-625d-56d6-aa5c-cd824d2e3605", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6415af6b-b3ca-5424-b27e-281a4550a5fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b172ad00-9740-5ddb-b6dd-2c2d22cf0dd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3d97b26f-24fa-585b-a8c0-10073fad28d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:81e8230a-941e-525d-84f4-13660a740778", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:54187007-2aae-52cd-bfb6-b2393988e7a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/upgrade. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:01158a49-6210-520c-bdc0-826d0ce39dec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8e7815cf-e297-5bea-9a56-490387987216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c0ddc751-0ce8-591d-a057-e5b5f04885ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:67e57c82-f049-5a2b-b730-3dcdf073f687", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9df0747e-dea1-5868-8908-1f0897de8cab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:669b0555-83ac-5ea9-8318-ae44c0b66149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fa0794a8-ec63-5f51-a659-6d806249a762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/upgrade. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:aaddc414-23d9-5b39-a233-1396f3b0d735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:69239ead-3dde-50c8-899b-cc91540c8020", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d8828748-72a8-529f-b6f7-9b072dbfa1b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@17.1.0-tuxcare.5" } ] }