{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7116b9a8-8767-50f4-b9eb-a6bbe4f6ca7a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/elements", "purl": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1b4702f0-3aaa-571c-9c0b-37281e187989", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ac0bbb7b-1194-58f7-ab9b-721a1396558d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:29789f5e-99dc-547b-97e5-d19636cf71b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:eee311ef-bf6d-5c2e-8b0c-843e85ced7c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/elements. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:742da3a6-448c-5761-ba1c-1c00a415c00a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:acf14711-f539-53cc-8787-d37dd1060fab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1b029022-35d2-5f69-94d8-c1123561d68e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fe5104c1-da1d-5acd-8026-8845cc17ec9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0134dd2a-99ce-555c-9ce8-cdd3baac1c87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5c41a9c5-c318-51be-9d90-166e6ae1253b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9f232cb8-8c38-5a0e-97de-317f1baf23ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4eb7486a-3e69-5e55-b140-6b9b0515e359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:896a122c-90a2-50c7-bc9b-ea7eeb97cd7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c3264f7d-0b35-580c-801a-fb001c110096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3ecdbae8-3b20-54ed-bc32-45dd6370bdcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f8fb9721-02ed-5e7c-8fc4-4cfc41de7723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0d00d8b1-9d77-52c6-8629-7b4340803a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:334166c2-80ff-523a-943b-729702d9fb69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:72ab435b-dca5-51a0-9fe3-ea3e5ead953e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bece12cb-c8be-541a-a672-c252fa150dc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d4bee546-b1a5-5ff8-a075-4f73603f2eb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f51d5ef1-0258-5a17-95c1-358548d0928f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:1418339b-5e0c-5489-a5d8-8da160e244ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ad873936-d1e2-59bb-9899-95c83dd58db7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ca53a571-cbb5-5259-b92d-e447c98fb0c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:cbc78793-25f7-525a-9fd0-71a6e13b38f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/elements. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:70b9f396-7c99-50ab-be89-384e2abadbd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5bec302b-1e36-5233-89c2-522396ae8cdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4e5efef5-cf74-56dd-a0b6-a5898219d79c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5ddd3705-4f60-5dbf-9b8f-1c2d69abafb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/elements." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@17.3.12-tuxcare.16" } ] }