{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:54966f95-6faf-534d-b58a-badc9180d19a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6b6e62e9-2eaa-5d41-a2b7-09d580791c71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c9540314-83b4-5ba0-a4e5-4f53cf09d7dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:878f61de-5379-577c-9da1-f3995731525f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7ff371da-eaf4-5385-883d-b1fc96d897a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8ff3311f-e893-5aa6-afbc-bafc8aa7e28a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:648945fb-efbc-501d-963c-c39fc3c12ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fb6bfc45-35d4-565c-8e32-4facfba264f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:55db25cb-efea-5207-9eb6-692847879df8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fd7cc3de-33c7-530e-8e8d-cce4bab2de9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ca123c06-9498-5441-ac78-0e4879bd7760", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d15ad70f-4ddb-5ebd-a727-fc26d83b06c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:98b7c48d-27e3-50e0-9a38-38b1873a6df8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2cde0dc9-366e-519a-9abc-f53d20c02a3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:116e040a-d65c-5ee5-b5eb-8fca3f7917fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ce466041-8a88-5f00-b1ab-35c0e9e75422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1202881b-5157-5a43-abf8-09a37a6290cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e8766253-05d5-5e46-b3b2-95bd45d36c1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:94d7392c-e428-5a2a-a72c-61c02c484839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a92c3652-07e0-5cb5-bf92-20e74903a170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/elements. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:35b4e065-4d18-5b3f-8351-e1377c584661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:666eb9dc-a5b9-5945-9eb9-c1b360a1be8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:cc2fd57e-56fd-590b-a235-005546eebeac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:82a38288-26d2-5343-b5bd-6f254d65c443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:910409a0-e43a-5d4e-9da7-c1f702b7c9d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6f028cea-18b4-59dc-b1fb-5b7572900a78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9a4dcf1e-0e30-5028-8648-6c1291023a34", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/elements. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1113049b-b64a-53c4-95e3-0c13396c8a9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2c4a3540-ce4d-57f3-8bf8-09bae01f5151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:aa65b466-5f10-56c2-aa6e-5549aae3c0fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@17.1.0-tuxcare.5" } ] }