{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c22b56e8-abc3-5c6f-9c81-eba50d3543a7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:22537c5b-4e5c-55d6-bea2-9d3205c90e49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d1ba5926-cdb7-53e0-b6e8-f2b05bf30107", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:31b21fb0-9f49-56d7-ad11-779cd853a574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:705fb05c-af83-5a11-9b11-0ce26d31a027", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ae75d31d-cdb1-51da-9b3a-8b4a97a293fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6248d1c6-bdcb-54b4-ab98-26303f127ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:bd4a52ec-5c74-58fa-8667-dade3126958d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b251e282-5a5c-5d05-a66a-7ca332f6188d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ba4f6239-9ca9-5513-b3e5-9f1abff89e37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fe9f3969-3dea-5716-836e-4d8b044e8c4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6a1ebb59-dc1d-56ab-b6db-62b78b0a6150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:969a0fd6-ccd4-5483-a90c-a8ba0a2cb578", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:00892195-d07b-5d24-b226-bbb784977d0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ece4c8d6-941e-532c-9f3e-0eb2083d9d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:34b947ab-cb67-5463-ab6f-882e81de72d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fb781bfc-bb0f-515e-bf86-953c102761d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2d053b3c-5a3e-50a9-b003-9ed071ba8b64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:931db3ff-d9da-55d9-8c39-0d2a5ba49475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:cbd57e6b-9d84-54fa-898c-f9c6658bdac0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/compiler-cli. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0f44986d-3627-54f4-8c55-d426ed0e949d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b381fcfb-d7d8-5092-8412-d7ca92d51403", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d3c08c46-2694-5ce2-9678-89d5132a6559", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e8abf4bd-958c-5418-9df5-29defa241a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:94f2bd45-b791-5537-921b-e786f5c24276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:48895ae6-ce14-5370-af23-507de908a676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:df75e30d-1916-59d3-aa00-a0ccefc34a54", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/compiler-cli. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f0ca4e44-168d-59c0-be9f-63a5a0c0dcec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:acbbd518-721a-5ca6-a1a0-2440eb3be131", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/compiler-cli." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:76d09dc9-2cd5-5479-8669-f3d987260275", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@17.1.0-tuxcare.5" } ] }