{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:80e68f33-2bc2-5b58-8270-864cbe0ab15b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5", "version": "18.1.2-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:b96b15df-b359-5381-878a-fab33e66de58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:54b17f6a-e5f3-5fef-9ec1-ec9cdc5def83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:f861ec71-f2de-55dc-bc3b-bdbabd110a87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:b266e26b-c852-5052-8d14-5312ba4cd857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4de291ab-935a-5351-bbe6-cc6a4443b98b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d4defc00-4337-5e4c-a850-bacb63bb0797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:244d780d-1b10-5eb7-96c0-35fe46d97deb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4c88efec-42ee-587e-b290-bdf304c5f5ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:69a72cbe-646c-52fb-a79a-551934990382", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:303633d8-3d36-5339-9a4f-cdb4c980a387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:8957bf1b-7000-5290-9595-1db103900bf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:e6ef398d-8b0e-5340-b5bd-7e7b22d24ec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:38cb7641-cdb7-5316-b17c-8a219ba70867", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:52581496-b417-586c-a008-209af467fe39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.5 of @angular/bazel. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:f9aee243-1c42-500f-863b-022bc90f468c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.5 of @angular/bazel. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cced3fab-b6b0-516d-9ebb-721858d1d7cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3b8249f0-85d2-5551-8856-60141e3d63e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:540c9afb-de56-5fb8-ac3e-6214ffde2977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:cb774c0e-e1a3-545a-9c2f-07e91ebe089a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3cbfc4be-7bff-5bb8-aef6-4fbee09b215d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:533c7eeb-f2a6-50ef-9ff6-5a5de348a30b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d5377e6c-8af8-50da-8c8e-6bd36f96339b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0bc15812-1a4a-58c8-8ae7-4dcac3d0c658", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0003b419-823a-57ca-b586-efbedf012b3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:8a823978-3429-52ff-a391-cca3ef3495eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:793d3047-51c7-5ccb-8353-ade48334cafd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.5 of @angular/bazel. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:b004878f-3616-5d4c-acb0-6a45e31a2721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:024b9cee-ff04-5803-a4bb-fc4bb7e7159e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.5 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:73ec01e1-48cc-545c-9934-790e02e41776", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.5 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@18.1.2-tuxcare.5" } ] }