{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4477b093-7ea7-5a9b-9dea-0b7ecc8c5656", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9", "version": "17.1.0-tuxcare.9", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@17.1.0", "type": "library", "version": "17.1.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:fc1e37bf-4bdd-5c0b-92b9-6b1625e0d4b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:a806675d-cebf-59f9-8e18-f2e2858a2b95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:9f0b0264-2256-5a09-86e8-9e633214ad50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:0f21a76e-82c7-5bb3-a173-28f4d778d450", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:5e70ef67-1b2a-53bb-9476-300861e07f1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:dc9dc99e-3937-51b1-82a6-15698347ea55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:ade20b6a-cd45-5253-b4a3-01a47ec95516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:d61840b6-9b22-56e8-9004-62093819e660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:db2b16ff-8adb-5e50-bbbb-b55b6433b001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:ad342a20-3f23-5316-916c-b36e2f84b4d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:3678d22d-7814-5747-88c3-33851fd8cec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:e78d4c34-33ea-5f8a-acaf-fa47992ea586", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:3097bd84-a584-5e97-bb29-2e3d5fbdf291", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:8857059a-0e8b-5f8f-9348-40302d26fb19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:ef92409d-6c7f-5ce4-b563-c64fb341947a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:8529c3e2-1276-568a-88c2-a9b27cf65606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:dcd9e66d-f402-50df-84b9-e8e48942b7cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:ba6554d2-0508-5c8c-95d4-ce8995599c09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:dcea743f-d907-5137-86d1-30c7cac44ee5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:9b0aaa0c-60fc-5304-8b04-d37b469a8202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:7c5feb6d-3fa0-5cf6-ba87-4129dca761d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.9 of @angular/benchpress. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:31aa87ba-6936-5efc-be82-62cfe66f8f44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:75fd1b90-4e73-5bf6-8645-fbd411a42921", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c88966b9-58d9-5591-9a37-2f059cf17d7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:cfdd046c-707f-5a45-9775-69f74ec1b734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:cfae7a34-305f-510d-aa70-a766d42d658e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:8fc06256-c5a8-5be8-a924-90c6a1b6aa00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:b5064e5b-30b8-50a7-ae16-f15188129723", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.9 of @angular/benchpress. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:e4c79d7d-4ef5-52ad-8ec7-e009073cc30f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:7f98cda0-5e98-5756-8f7b-15457b8ab735", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.9 of @angular/benchpress. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:82d51f5b-9aa2-53ba-8f58-c36137bf03e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ], "bom-ref": "urn:uuid:8c518464-c818-5a86-8ca1-329b580746f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.9 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@17.1.0-tuxcare.9" } ] }