{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3400ec64-db90-56ab-a3cd-4ebfa35d2d24",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/animations@13.3.0",
      "type": "library",
      "name": "@angular/animations",
      "version": "13.3.0",
      "purl": "pkg:npm/%40angular/animations@13.3.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:0d5ed23e-fb12-5216-951c-eec34830ce9c",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 The target repository (Angular 13.3.0-tuxcare.1) is NOT AFFECTED by CVE-2026-41423. While the target lacks the explicit sanitization that the upstream patch adds, it uses a fundamentally different URL parsing mechanism (Node's url.parse() without base URL) that does not extract hostnames from protocol-relative URLs. The architectural difference prevents the SSRF attack vector from succeeding."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:054f06f9-fbca-5f8c-a872-ac0aae2f1090",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular v13.3.0 is not affected by CVE-2026-50170. The vulnerable component (HttpTransferCache) does not exist in this version. The HttpTransferCache feature and automatic HTTP response caching during SSR were introduced in Angular v16+, while this target is v13.3.0-tuxcare.1."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b96f6bc5-ce31-58d9-8c16-f1a43feee812",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54264. The vulnerable method newRequestWithMetadata() does not exist in this version. The AssetGroup class creates new requests with only URLs when fetching assets, never preserving headers. On cross-origin redirects, the code creates a completely new request with no headers, preventing sensitive credential leakage."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b847556c-3a18-5eda-8a8b-a63c7635afeb",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54265. The vulnerability is specific to Angular's template/pipeline architecture (introduced in v14+) where TwoWayProperty operations bypass sanitizer resolution. Angular 13.3.0 uses an earlier Ivy architecture without the template/pipeline system, where two-way bindings desugar through the same parsePropertyBinding() function as one-way bindings, rece..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05e67309-0f73-5220-95db-554975cfa03d",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, and version 13.3.0 predates this feature."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05391322-b8ef-5956-909c-ca151cb037f9",
      "id": "CVE-2026-68945",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular v13.3.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular v16.0.0. The cache-key collision vulnerability requires the HttpTransferCache's sortAndConcatParams() function in transfer_cache.ts, which is absent from v13. Verified by filesystem inspection, git history, and existing patch documentation (CVE-..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de459d0d-2026-5a98-be41-a6f5d92c5cf2",
      "id": "CVE-2026-88056",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular 13.3.0-tuxcare.4 is not affected by CVE-2026-88056. The vulnerability involves using String.prototype.trim() on URL strings to strip Unicode whitespace, which converts validated same-origin URLs into cross-origin protocol-relative URLs, enabling SSRF and credential leakage. This vulnerable code pattern was introduced in Angular versions AFTER 13.3.0 (likely v14+) and was fixed in v20.3...."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d60ea6a4-8fbf-5de8-92d1-3b2dce95a34e",
      "id": "CVE-2026-88057",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 13.3.0 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7c94e5ba-3b57-5fe3-91c4-b2ad55a3e096",
      "id": "CVE-2026-88059",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 13.3.0 of @angular/animations. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation via withRequestsMadeViaParent(), features introduced in Angular v16.0.0 (September 2022), six months after Angular 13.3.0 was released (March 2022). The vulnerable code paths, files (provider.ts, transfer_cache.ts), and APIs (provideHttpClient, withRequestsMadeV..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:02e8922c-80da-5fde-bc68-bb6968206423",
      "id": "CVE-2026-88060",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 13.3.0 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@13.3.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/animations@13.3.0"
    }
  ]
}