{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04417c00-c241-5455-b66d-bedabe0319b4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/localize", "purl": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3", "version": "19.2.25-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:651b8764-c2de-5a3d-9981-66f2ee5c3127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:10364519-8b20-5612-a30f-ca1d62255662", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:4f660e5c-03c6-549e-a122-29b1885d61a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.25-tuxcare.3 of @angular/localize. Angular 19.2.25 is NOT affected by CVE-2026-27970. The vulnerability (XSS via unsanitized attributes in ICU message translations) was fixed in upstream Angular v19.2.19 by commit 747548721d authored by Doug Parker (Angular team). The target version 19.2.25 is 6 patch releases after the fix. The defense code is present at packages/core/src/render3/i18n/i18n_parse.ts:843-867, implementing allowlist validation, URI attribute blocking, and unknown attribute dropping. This is an upstream vendor fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:d62bbdf0-d5a8-53b9-9b5d-ff7f07990d3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:4155aa4b-ed1b-5270-8bd7-c515624abcab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:06f85a27-2461-55da-b5f8-f56158c70a01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:1fbb163f-7cb9-5612-bd53-e5ed2932a9b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:5727cc9e-2ba7-511b-9938-ec076f315449", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:88ee433c-8487-5b5f-88ba-dfcdd51b6c91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:e1006e1e-bed7-533d-9563-7c6564e3340d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:44765d76-1e04-5d51-83ba-9b84a100a34d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:c85fddeb-c5e6-5089-8b53-d7a9423f5f64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88056 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:14593e03-9e88-513a-af0c-4d7c2b2b95d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:8a7deede-7bec-59a0-97a0-3aed381e52c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:020cec21-5de4-5e51-b8ee-4d667f06b3be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 19.2.25-tuxcare.3 of @angular/localize." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ], "bom-ref": "urn:uuid:0a1a3a3b-b621-53a1-be16-d0acc62a5efb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 19.2.25-tuxcare.3 of @angular/localize." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@19.2.25-tuxcare.3" } ] }