{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d6abe252-111e-5169-b5d6-b77d561aa9fb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8", "version": "5.1.2-tuxcare.8", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@5.1.2", "type": "library", "version": "5.1.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:7470f191-7b21-5c13-92a5-1b2809162bfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:ffa48148-122c-53c3-a962-479498c8d21e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:e091e632-cc50-5fe4-8bdd-441ed4f4e284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b854bbe1-2437-592d-8612-34451ab5030d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:af93ca54-a18f-5afe-a183-d05d9acd0184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.8 of @angular/bazel. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:12fcd504-4ae0-51b8-b396-d0b3f2921c53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:37663894-2183-5347-858f-d76cec6d97f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3a250b33-6757-56fd-95fc-bc7c07b3910d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:4067f801-e86e-5602-bfc0-54824bc19b94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a753f8b1-bd43-5c6d-904b-3f10bf899008", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a641712d-7255-5e33-a653-e8f825b16703", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:55c885a5-d517-504e-8581-171b0b11660a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1432f74c-7358-5525-9e91-065eb05bae2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.8 of @angular/bazel. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:36e99849-53fc-531a-b6e4-bb4ad17e1e17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.8 of @angular/bazel. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:45a4cc64-aaca-59d0-992b-641aaa195e1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:8170616c-d41f-5deb-b30e-a8bbd5fd118a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:02f67b3e-4403-5ef7-a8c0-df278bb16262", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.1.2-tuxcare.8 of @angular/bazel. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-88056. The vulnerability requires a URL resolution utility in @angular/platform-server that strips Unicode whitespace during SSR HTTP request processing, causing same-origin URLs like `http://trusted/%C2%A0//attacker.example` to become cross-origin requests. Angular 5.1.2 lacks this mechanism entirely: (1) The vulnerable code (url.ts with parseUrl calli...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d68b7dd3-1799-5bf4-b7cb-1ebf529ed13f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:1b7e117d-2864-55fb-a8ff-a26e3debe5f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:28fd6554-5718-5d61-9277-2b6adf046a0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.1.2-tuxcare.8 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@5.1.2-tuxcare.8" } ] }