{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b9957370-0677-5efa-9d17-3a38ae174122", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5", "version": "18.1.2-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7e3fd34d-031f-585b-82eb-22775e91b653", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3a69af78-4b91-58c2-8688-e6667ad479b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7871c03c-9833-558e-8629-b1a3e8c565f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:f9713da0-a1f4-5c39-9122-b6d455031767", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:7578a5ba-510f-5109-afab-25a1b7ebdd53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:410d9578-f5a7-5a85-8dbf-0e36342b3370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:587048dd-57a1-5e31-8c21-539dcc7d6d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:f17b1d68-a788-5716-a5c0-c3a4f4fc8287", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:1b415231-7e24-57b7-aace-2c2e231f3949", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:9f585993-6f0f-527b-b28b-d97d50d096ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:4454163a-cd88-5667-a989-ad84aa573442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:61d2d370-34ac-5189-a514-0b3ca9b38717", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:2c190a1a-0ba6-52ec-bf14-a634bc6068a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:0ece82e6-39fa-5b73-8f5c-b559c89ddbbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.5 of @angular/platform-browser. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:25cab1ab-5dbd-5a20-a814-1b654808e4a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.5 of @angular/platform-browser. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:15b6e098-80e5-52b0-a56b-ba44d55cabfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c5f11c86-8785-5cbb-b292-ee09818ea589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3a2a262d-988a-54d2-a997-f0405a138ae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d090cdce-ebed-505d-9a83-d246d72a74ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:d01c4e86-bcb2-5f1b-93a9-bf22fcea06c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:c66a8561-adef-5c38-af47-6cd44b56efe4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:16cde723-5a39-577c-9cda-79c5624a6455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:eb722ff3-e62e-5599-aa8e-978ae922cd05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3234d202-50fd-5e9f-9917-c2509f922a86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:5ffd2e6a-1833-50a4-bb09-b9edc25e1be1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:3a58e931-7ae2-5748-b676-f7271496b249", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.5 of @angular/platform-browser. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:8c34cc18-12a3-5b15-b046-58c9a439ead2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:be9b83b1-5d53-5e88-a493-b350b80ca29e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 18.1.2-tuxcare.5 of @angular/platform-browser." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ], "bom-ref": "urn:uuid:1ab9a5d1-d54a-58e6-96b9-57b3469f2ec5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 18.1.2-tuxcare.5 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@18.1.2-tuxcare.5" } ] }