{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04c66fcc-d38f-5523-93ba-bd555548f407", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2", "version": "19.2.21-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0c823c93-83ba-5d7d-b626-4969e2ac9eb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.2 of @angular/upgrade. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:d3bac24c-5e6a-51d2-8bb6-a27b5885b18e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:d62ece97-3347-579d-aaa6-bd38acabbbf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:04c116e0-cbd6-5e60-9ff1-b9ec90c0a43e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:f309e256-1339-568b-9cb5-a15516f1cf57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:133157e6-906c-57f5-8cc5-425e944f3a96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:9e9a3d2d-8bf1-505c-a748-a454e33cdddd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:012ea4f1-6e27-5b8b-b799-fc1c0a5d2ed3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:bd3b2c72-af70-568e-b48c-1c15e92b4422", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:1d290eb6-ba6f-5a2e-8e17-9456520841e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:74854ef6-7d29-57b3-80fe-6cf17d610ca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:ce4a09cd-06a4-52ce-ad7d-9580e09e7318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:0d194f8a-09d7-54b0-8d3e-06303a9a53f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:7fced562-d784-5b72-8529-a05c1de9398c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8dd7e6cb-4652-5c91-b7a4-602fde4a22b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:3e7468be-c68b-569c-be9b-664646566986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.4." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:55bf8e95-43f2-515f-b1ec-9b003a21efc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:aee8de1d-bd15-50ed-be11-6e51e6e3ae1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:5bf451bd-fe8a-5ab7-8c99-61f90462fcff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.21-tuxcare.2 of @angular/upgrade, and is fixed in 19.2.21-tuxcare.5." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:9f93ad89-6181-5d94-b429-2a77ebddeaca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.2 of @angular/upgrade. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:8d26902d-c53c-59e5-8d71-29b1c16021e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:f5e56136-c4ad-5bc3-8b0c-d78d219221aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.2 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ], "bom-ref": "urn:uuid:060948c7-fc01-54e3-9419-71fa11a7606c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.2 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@19.2.21-tuxcare.2" } ] }