{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5d615b1b-5725-5dac-aba2-7da228531a19", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:65020889-d90c-59d5-ae91-546dac57f67c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f7188b7c-6640-5134-b7e4-73cc3de68d19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:76079936-69fc-574e-bd8b-68be6336f113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3cac7440-bb06-5690-b9e7-bc69bffd6355", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/upgrade. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6320c6bd-5bcd-5f62-bd55-17ca14de672a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f1b75044-1de1-5c68-af84-a685fc035645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:127e92f3-fb92-5809-9908-e39566e6a29d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:21cee38d-509e-53fc-ae8c-799e62fc917e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7535235f-750f-5ae7-81cf-caa114d02ac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ac0a070c-3640-5c0c-882e-6cf859722f1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:89390776-ec63-5580-98e8-6000438d8194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f0104e8c-3400-5db1-933c-7aa188e2353d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:59349fdd-823b-5533-9370-95faa75a9647", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8240b662-1eef-5373-b85c-602584a434d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e48f9e3c-7e5f-5c1b-9ce1-d66a9db3927c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ae1daf17-3418-5a09-ae69-96f4c3dc66d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:be5a7d97-bff8-5548-8031-44860add5e17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4e439d61-d674-50e8-b96e-5844678d5013", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5834817c-3c87-559a-87be-ce0087a28528", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:da8e9bd9-3ee2-577b-a59a-fd29f5835cee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:afec6bb2-b8bf-54d6-b3ba-89ada5068ea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3639ab35-9656-506f-8767-a1978013f698", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b3daac6b-8caf-561d-8cad-7748bb7d63a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:04581922-9ff4-5da1-8d67-e15dc6c511e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:002b0904-4efd-51ff-854b-fcea52a081f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ac176006-2afa-5ad1-9c59-e89a749c6e46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/upgrade. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d37660eb-f3f5-53ee-8600-0dfc6e7887d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:805f09c7-2e05-581a-ae6c-d6308e712c1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:767ad216-bc72-59b2-a034-44e546c2f3eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0802f993-38f4-5f5a-91f5-3679266b3795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@17.3.12-tuxcare.16" } ] }