{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:352102fd-de29-5b21-b22f-2db2102530a6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7ee1d557-a088-5556-8853-a68953b12a74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ca35e6f9-7bc5-5f92-b2b6-e4beddbec9b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fe850c8a-c188-5df4-991b-1194b4cd6195", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b15100e5-9fd6-5a1e-9a55-a87b8a076900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/compiler. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1bd9c2d9-3313-5bed-9a8d-5c503c6d0843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1a4d327b-49ea-57bc-8f75-685c00c38cf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fd96614f-880a-5447-b234-b759af489b8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3150f183-4a2f-5d30-acc4-9f012ff07509", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:a12b6739-481b-523c-ad3a-5258abcfa345", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1eb8f8a2-02fb-5060-a803-d15d90072cc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:85466753-9745-58c7-ac7c-7d6c2c004e56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8bb6bcec-f366-5d72-82e7-45186fbda31c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8ce4f77e-3d93-572b-a96f-da5d5d7456d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:052b9c2d-467a-5e32-bc1e-0e56a7a91e80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fc331194-9f0c-5c7f-b39f-ab9cfd943e06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6a688319-e0fa-5b38-a6b9-5a6fd2e1a9cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c8f798e3-4c92-58b7-a5d2-3affad7151e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:664ff965-5a89-5a82-9e06-bcbb0aa8847a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ea111ddd-2204-562c-aab2-62c134b43fed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:663818a4-952a-52c7-b233-5239a3a9e8f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:84cfb28a-878c-5521-9517-240de250bb7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0338b028-1002-57e8-bb7b-9ab026dc2c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4e49275a-faf8-55dc-aab7-58d46ce41711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:52afdec5-d797-5ec2-a742-41b2f8161101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5f398a53-99e6-5cb1-a6d5-23755e5ff442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:508d881f-5ff0-5b25-b253-2b8dd8e99398", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/compiler. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:607e900c-35e9-5020-8890-28fe06ccf817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1c3f9aef-f347-52f6-9917-34bd2e374f7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8b902b90-feb6-550a-8acb-c3518d2677c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:df212c78-2b9a-5351-a69b-984cf122a3c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@17.3.12-tuxcare.16" } ] }