{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:abd675be-ee0d-5de8-8af0-a33f088122e9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10", "version": "18.1.2-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@18.1.2", "type": "library", "version": "18.1.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:48503a2a-a2b4-5417-94b6-69c9e09f6000", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:1cb13b3e-f636-5410-ab50-e51a41e5c367", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:7eb34b8d-3bb3-580e-b56e-50de4cd522a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:5d1221c2-8467-5bbf-9838-10ad41349bb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:87e0d886-6f8b-5968-bcdf-c585eb6315b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:73e5d7c9-6020-5a92-8d36-a029dcea4da3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:ad9bddcd-9871-5260-9a2e-4b2db4886c7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:4738ff7b-f61f-52f2-b566-182a03d3143a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:5358e5b3-22e5-5548-8ad8-79e8e06516c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:fd349bdc-bcf2-5b47-af81-8ad939394df8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:6a486c5f-c0b9-54b3-a724-651735b3a5f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:de386bfe-61e6-59c0-9e29-1e9a53e6c02c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:39d8b536-4a92-59cc-a453-38ba2afd4ea8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:32a3f3aa-b3f1-5909-9e43-0032fa3a12a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:8e3ddea5-8aec-51c4-9d61-7ae5ef409589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:b8275b49-5a75-563d-aa24-841b5d450ea5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.10 of @angular/bazel. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:5a38d438-9d02-5ae1-bf82-a76338818322", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.10 of @angular/bazel. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:7db94da7-e7de-53fa-a8d1-6b0d18e9d784", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:9ff55a48-aa21-56b9-ac08-5eeccd8bd993", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:41327c8d-299c-5759-bc3c-dbb6837ed765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:17867ba8-1948-56c1-bcde-aba71d4d6b30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:34eb4bf8-cb08-5468-bfb5-0657038a67c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:ec34a8ac-deca-5845-a30a-e41213189005", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:bb0ac7ba-e8de-5b1b-a54d-b559db72922c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:2e4fba9f-bd58-5eed-8915-e0a773092228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:a99f1b1c-a088-5c20-9f41-c1a73ea7e761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:a1f6d85b-92c3-5533-9dce-c247de9ae121", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:8a80b94e-9d9b-55b3-9019-4e323d2437ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.10 of @angular/bazel. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:cf9beb0b-20d5-5a1f-9e63-5b0ec2333751", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:96705954-0165-5f14-9506-af376749c894", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:2e1378b0-2fcf-523d-85d9-71c3d817ddae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:159ee226-0a4b-5f5b-bda3-79b1420f0c2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.10 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.10" } ] }