{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0e9bb3f0-d3f9-58c5-91d6-900dc99e4e6d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10", "version": "18.1.2-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@angular/benchpress", "purl": "pkg:npm/%40angular/benchpress@18.1.2", "type": "library", "version": "18.1.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:dab6ea15-c4e8-56ef-8e58-655e83fb18f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:43571fd7-b19d-55d7-9671-858b1e7fce89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:f0a0a10f-cff5-581f-ad72-cd7c6f2db12c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:a18859df-277b-5d0b-a529-d7041d1fe53b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:82ae0034-b4db-5ab6-ab55-7a1449c30dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:5ba5f532-52a2-5785-b008-a927a7a0a02b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:9af648a7-8596-595b-bb33-3dc62cb0e083", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:3c24bba1-7fbf-5108-9018-0867bfdd9d05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:6facbdd0-93ce-5277-ace6-4a210075b5b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:e3ae461c-1cff-54c2-b005-a46ad5649326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:3834f9c3-3b9e-523e-ba9f-accc3d7761e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:291b978c-542e-57ac-99b9-022d140a5fab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:c280cef6-6a19-557d-984b-dc8719cff038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:4d0e0a40-0d40-5b95-95b7-8ff4e69ea833", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:386f306b-43a5-515c-a77f-9fb7fb6734a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:4bba23c2-c6bc-57b4-9d97-8236f04471fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.10 of @angular/benchpress. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:0bb9126a-4ec8-5eac-b843-2b43cb7ae18a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.10 of @angular/benchpress. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:5f5cee58-b0fa-5919-a1e8-8a5b7943b30c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:17274de5-9022-5b8a-b7c1-9139a3e4a090", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:701dffef-8cd2-5c28-bf1f-c83dd5ecca75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:5453df35-fd17-599c-9f78-ad64dd2bcf62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:c9c2d12f-c853-5dcd-8571-cbc41660496d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:983a52f5-209c-5646-a3ce-7b675ef0324a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:2c545626-0337-57d6-8272-94563f21b3eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:7f159f31-e208-5705-8c1e-4f49d76227e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:f5a4a42b-7102-57fc-9050-dce4bdb354e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:470151af-f83b-55ef-b8d9-7122996b9010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:f34bc75b-5a36-52b4-8ac6-961e6c82e783", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.10 of @angular/benchpress. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:111a9f4b-95dc-5ac1-a074-fc9bdae12453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:34359707-9dcc-5857-bbbd-ba29d2394f1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:844cdc79-bd19-5d2d-996e-ebb3a39a3f90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ], "bom-ref": "urn:uuid:3fd99ff2-9e82-5d61-bab0-93d12069f7b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.10 of @angular/benchpress." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@18.1.2-tuxcare.10" } ] }