{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6a23e56f-e5ce-571f-9658-b0d84f5c5ecb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser", "purl": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6", "version": "17.1.0-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:572a18b6-f28b-5d7c-88f9-66e8dc9f82d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:83b269f5-3add-5924-aa8c-b7d525c561da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:74d9ee44-48e3-5c49-8402-2b6088d48b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:bef4afbd-8882-506f-b13e-3f44c8a8c60d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:d1ce618f-c9f8-5c59-bf60-5e1fc5ed63ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:9ce73d63-3d5e-57f7-959b-b1049de2a55c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:2dec328e-5f62-5866-b8c7-40d5a050b7a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:a9097a12-c588-587a-8566-d6a77618be1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:f54438ea-a153-586c-aa32-0b60f2c47ad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:58269ba7-410f-5618-80e9-58812d493eaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:676b777e-2153-5a71-bb7a-30d26ce9e34c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:c5d2dcaf-ff25-56f7-bad9-05a9cffd9069", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:a6d90cca-61aa-5bf4-aa97-cbb73a68738f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:d923d964-2b9d-5d9f-91b2-c6fe9355cfc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:17dff2d1-17d3-5e5a-b1a0-9b2eea7bfdde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:91e3a324-965d-5373-aa0b-61e4abeba502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:d3819023-b88e-538c-b267-d83f322ad167", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:c9dbdeab-dc80-58cb-bd30-2b10ac200189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:8d7e74b0-188d-593e-8562-999b53f92d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:d0439bfc-1906-5634-828d-1982c183d9c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.6 of @angular/platform-browser. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:48b4c7c9-8eca-567f-9118-f093ddd437f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:a768d400-13c2-5071-8fe6-cd9996e93e59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:4425cf29-0eb7-5b89-be75-4d5af74f1ae8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:4ca0b736-7506-5bbd-a469-1fded8deff9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:257ee914-b38d-5037-9cd2-fb50ad81193a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:2e37dda2-deed-535a-b441-b221d1fd9640", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:9ae4a166-9b9f-5c2c-a393-dca1cb45623f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.6 of @angular/platform-browser. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:92230575-f03d-598c-a50e-1ac6a8e7f963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:e5a3eafd-aca2-509e-b594-5071125b5d40", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.6 of @angular/platform-browser. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:0d239c1c-746b-5543-bc2e-65feacd394e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:8f119ef2-1c25-5cbf-a619-560b5eaff258", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.6 of @angular/platform-browser." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@17.1.0-tuxcare.6" } ] }