{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9dfd7ad8-9cfb-59ee-80cb-ac4c0db4889d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20", "version": "5.2.11-tuxcare.20", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:99e70539-0001-5263-b37b-2e07d80db390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9d4835da-452a-57e8-875f-8241ed8da347", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9821a7f3-e45a-5483-bafe-4a42d3758418", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:96584083-b029-5751-8346-78f21d7be0a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bb2d683b-2b70-5371-8fce-9aadaa1d9ad2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9482324a-1d11-5e71-b461-9c0114984dbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:387d2578-b281-5849-9133-51e50e1440af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:89fa6abc-64e0-5e7f-8d08-85eb1e630f3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:2c23f2f6-a43b-5a9f-86d2-2d746fe302f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:2b035977-b5b4-54a0-be65-4ae3aa1357b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:f2a3f058-78cc-5e9f-aaa3-0d88c29666c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:4f2d4efe-785a-5175-a486-a7dd52fb396b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:c6ad038b-9c7e-57f1-b8de-26817f420a26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bf1ff662-ee22-5cfe-b4ec-544ca34b886a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:737f80b7-d19e-593f-861e-0ff0dd8c3b39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:fff7eb86-7609-5d52-b333-4c2e38299502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:c51b3c8c-6639-5b84-88fa-916663777b7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:703677ef-284d-5581-8b94-9ec957b651a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:29d39885-8096-55f6-bc68-ddcd8e06b216", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:41c07010-8fef-5a25-b750-223ed7e34ef4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:7c9a702f-8805-59e3-950f-f52b0f210204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:49f0bdb0-a9b0-5a7e-bd49-806915067476", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.20 of @angular/animations. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:260b59ca-2165-554e-980c-178af0df3941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:b7baab1c-7a01-5c7b-bb81-fed7595bc2d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:62322149-b4c5-5a05-a0df-d9b8760a2e7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.20 of @angular/animations. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:e04cab05-4bca-5223-b401-b76c6eb891b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:8904bbc1-f007-56de-9fe5-94fe71e5173b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.20 of @angular/animations. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5f846c85-32f6-535e-bf42-24e9c257f46a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.20 of @angular/animations. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:52b80cf3-9b50-512c-8cc4-7528bc16e00f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.20 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@5.2.11-tuxcare.20" } ] }