{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:428a3cb2-6484-5f7f-b718-7316f92de31a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6", "version": "18.1.2-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1fb0f45f-0fb2-5c0e-9cd1-a1865047c4a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:161a5ca9-5320-505c-8d71-0666ed09c069", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:12c38476-e548-51ec-8b84-4c3c0c5e227d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2ced4395-5445-5253-900a-8b292d318959", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 18.1.2-tuxcare.6 of @angular/upgrade. not_affected \u2014 The Angular repository (v18.1.2-tuxcare.6) does not contain the vulnerable code for CVE-2026-101895. The DoS vulnerability exists in domino's HTMLParser.js (after_doctype_name_state infinite loop), but domino is an external npm dependency whose source code is not vendored or bundled in this repository. While Angular's platform-server does call domino.createWindow(html) and exposes the vulnerabi...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:3047f750-baad-5da7-b76a-d75c3e0cfae1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:06cbe907-1d60-517f-9d52-46c245e473e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f2703f3c-0ab9-5776-840f-b42f80a861dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:48e7ec7b-2e97-5062-a821-6ed7ea014e67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:413c3813-05dc-5ee9-8c11-b9393f17e3af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:13ea11ee-bc2b-5c21-808f-c5004391f202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:6ffbac36-644e-5440-8ab0-0269aeadbebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f636383f-19f7-594f-b529-7c046f3f5dcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ab536d74-0d12-56db-ab03-6a598da5da89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:aebfd615-826b-5c0b-bebf-4ba5a05f77ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2f811add-bf7a-5956-8dd5-87c4380e05e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.6 of @angular/upgrade. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:91697487-433b-588d-a1a4-f219ff4ef9c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.6 of @angular/upgrade. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5b6b4096-b69b-5174-a884-6936ad29bb39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:98fa05d6-30f0-52ea-bce0-40cdecc1a7e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c9078be6-bd41-54fa-be48-e6f9bc22d70f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1e069cea-fc1e-59c9-b565-1a921797b2ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ae848da3-3e55-5299-b5f0-bdb7a1125573", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5c0f6e74-5c44-5344-ae58-cce09acd8a00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b50d8c72-c875-5ce6-a907-6eb4aac00835", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:dbcba80f-d5e0-57f8-a652-00e6d197812a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:121dd2b9-e91e-55ea-a83d-5fbe4002479e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b1952724-78c4-5feb-84b6-edfe30b22054", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:11731546-9d91-5f32-b9ee-833781b41a81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.6 of @angular/upgrade. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b80fe920-3ee6-5b07-b869-347da543a92f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:56b72eda-06c3-5f97-a3de-151f5278b20d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f0ec70e0-69f2-59d3-939f-7ef7efaf7217", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ], "bom-ref": "urn:uuid:02b86a51-23a9-5edd-a5f4-c1c29ca2f674", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.6 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@18.1.2-tuxcare.6" } ] }