{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:52201ab6-838f-5018-a8a8-df333f06c8d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20", "version": "17.3.12-tuxcare.20", "pedigree": { "ancestors": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@17.3.12", "type": "library", "version": "17.3.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:85dd4408-4003-54fa-a8f2-47fedecc4e9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:6579733b-7974-5eea-9913-21f8acaab62f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:f3c877e1-89d4-59ce-9a28-8f942db86194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:142d8650-54db-5bd0-a313-949b9787a0fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:d3565ccf-764f-5846-97c4-52a41fb32aa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:63aecf8f-f0a4-5cae-bfe1-cfc49e8de6de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:6f539d02-4943-5394-93c8-31aa7b3e189a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:9edd53c9-e483-5a8b-86b4-943012dde6cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:0aa535db-5558-59c9-adcd-c95462d37c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:9ba52c53-0d42-5e59-8114-124b8af21bde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:861a5322-db61-5ea1-870a-363903792185", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:f8374f0b-6d52-5376-89a8-87fb39786bf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:1e8a1f5c-eac3-59f0-86bd-9baefd0a8119", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:940e825d-07af-5b0e-b585-a31708939d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:25150975-d141-533d-b2c0-3baaad1b52d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:079245a9-fdf3-51b3-aec3-fa14a5b6867b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:9245cb8b-23b9-5e4b-80bb-335dc6a1eafe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:449cfd06-f915-514e-bfd2-e500397efcc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:bff9b2c0-88b8-57fd-9eae-ec69e6ec2801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:d744fc57-cec7-5fa0-bb58-2ce7e19f2831", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:0e95078b-9c55-5fd9-9cfc-7e07c5df1aef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:d317d0a8-f845-538e-b90f-3e636eac2383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:bbee2aa7-df1d-5435-92c2-0e17d8fa9691", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:8cbe545b-978b-5a2e-8267-97f03332cb6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:72d21d31-0614-5708-bfec-fa638eed93f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:c23db7c7-7404-5f57-9678-7aecb61ece58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:b63ce756-268a-5da4-abf2-0b8adbfbf354", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.20 of @angular/localize. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:0911f8bd-0056-516f-a4eb-92e2fc2c388d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:1e5de140-d550-520a-9dea-6f3c6233a0c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:e2f4c263-f9d3-5240-ad86-5ac7bfee0d3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ], "bom-ref": "urn:uuid:491d572a-80d1-55e2-a6d1-30481f10c505", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.20 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@17.3.12-tuxcare.20" } ] }