{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0c36d962-509b-5564-831c-76dccf83cafa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11", "version": "5.1.2-tuxcare.11", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@5.1.2", "type": "library", "version": "5.1.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:76d2146e-cec0-54b6-ba40-1c375839304e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:779428eb-b430-518c-b48d-ca41c70ffe6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:e19562ae-69ac-54f8-b1f0-39ac2b7e840a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:447d1e1b-547c-506d-9183-c2b346a5326b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:b7243b31-2938-5cf5-b6c4-bd1fbe899be4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.11 of @angular/bazel. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:1e24ba98-99b9-5f16-92fb-21a78c41b94e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:255373c1-35a2-58aa-84e9-104654ceba9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:7444ef31-1197-5fe6-8406-9e3c7989fac9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:8b8268d8-d6f1-5f5c-bc51-bf631a35502b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:61b9975c-63e3-535e-a741-41199a710cb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:6730f571-26dd-5956-8c66-14f22216fa51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:adf81645-a04b-5571-9053-a1e49db4701b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:46fbb6b6-9ba8-57c0-9ef6-643c7a561000", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.11 of @angular/bazel. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:08d31650-2fae-5b22-b43f-9c1132e15651", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.11 of @angular/bazel. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:e1f8ff9e-9889-5d21-a00e-1a5dd2b72620", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:793b9edc-29b8-5473-83b7-094233629fc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:0cc3f880-ee24-50d9-8057-4f06ac6ce5d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.1.2-tuxcare.11 of @angular/bazel. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-88056. The vulnerability requires a URL resolution utility in @angular/platform-server that strips Unicode whitespace during SSR HTTP request processing, causing same-origin URLs like `http://trusted/%C2%A0//attacker.example` to become cross-origin requests. Angular 5.1.2 lacks this mechanism entirely: (1) The vulnerable code (url.ts with parseUrl calli...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:bed49819-b549-5266-acc2-1b2ff0dbdcfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:654db0a6-b6e5-55bb-ba4e-dc710d609282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ], "bom-ref": "urn:uuid:07155cb8-c3fb-5e19-8a04-c874a6ac9a94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.1.2-tuxcare.11 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.11" } ] }