{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8cd707f1-fd7a-516c-a918-b548a3b98744", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@19.2.25-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3", "version": "19.2.25-tuxcare.3", "pedigree": { "ancestors": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@19.2.25", "type": "library", "version": "19.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:7ff4e7ee-b8f8-5ad6-bcf2-19f60cd444b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-4231 does not affect version 19.2.25-tuxcare.3 of @angular/core. not_affected \u2014 CVE-2021-4231 affects Angular versions up to 11.0.4/11.1.0-next.2 through unescaped HTML comment delimiters that enable XSS attacks. The target (Angular 19.2.25-tuxcare.7) is not affected because the upstream fix (commit 47d9b6d72d by Misko Hevery, December 2020) was already present in the upstream Angular release before TuxCare onboarding. The escapeCommentText defense is comprehensively appli...", "justification": "code_not_present" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:35fd361f-c430-573e-8278-ec96242e586c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 19.2.25-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:727ac660-6bd3-56b8-9f13-ab07ff6666c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.3 of @angular/core. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:01fd2b20-84f2-5e33-9ed1-e97810614471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 19.2.25-tuxcare.3 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:f9e57988-f92a-5226-ae92-09f2463d5a2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50557 does not affect version 19.2.25-tuxcare.3 of @angular/core. not_affected \u2014 CVE-2026-50557 is NOT affecting Angular 19.2.25-tuxcare.7. The vulnerability (namespaced script element bypass and security context schema gaps) was fixed by upstream commits that shipped in release 19.2.23, which is included in the target version 19.2.25. The primary fix (commit fe1207e8c5) ensures namespaced script elements like ':svg:script' are properly identified and stripped during templa...", "justification": "code_not_present" } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:10f433aa-f461-5efe-a643-fca84c8c604c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-52725 does not affect version 19.2.25-tuxcare.3 of @angular/core. not_affected \u2014 CVE-2026-52725 does not affect Angular 19.2.25-tuxcare.7. The vulnerability (mounting components on script elements via createComponent) was fixed in the upstream Angular release. The fix commit c6bb0692e2 by Alan Agius added a runtime check in locateHostElement() that throws when rootElement.tagName is 'script', preventing XSS. This fix was already present in Angular 19.2.25 when TuxCare onboa...", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:5a1b228e-b2b5-51a5-8027-ef9d2661fcc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.25-tuxcare.3 of @angular/core, and is fixed in 19.2.25-tuxcare.6." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:ef7e0136-8ead-5c42-81da-a366402118d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.25-tuxcare.3 of @angular/core, and is fixed in 19.2.25-tuxcare.5." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:04c3dbe7-56c0-5539-bad5-65198289b988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.25-tuxcare.3 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@19.2.25-tuxcare.3" } ] }