{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:957630a0-e54e-5c61-aa0a-a98b8e900eb5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9", "version": "6.0.1-tuxcare.9", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@6.0.1", "type": "library", "version": "6.0.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:d919dc46-bc61-5d27-8990-8d25786318e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:6c4179b9-31f3-5e0d-a9f9-f614451ba315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:5127830d-4c38-5f94-985e-eea13d29d671", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:dff59965-b094-5a66-805a-c24f71e22e08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:515e044c-3809-5f27-85b1-c083359a12b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 6.0.1-tuxcare.9 of @angular/bazel. not_affected \u2014 Target repository (Angular 6.0.1-tuxcare.3) is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API's protocol-relative URL behavior to override the base hostname. The target uses Node.js legacy url.parse() API which does not exhibit this behavior and does not extract, store, or use hostname information.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:172bba30-1280-5f5b-99a3-4e89dc8372fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:2212801a-0a0d-55dd-8114-189093b733dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:18da2d78-3fbc-563b-a918-3101e0cfa89c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:40029b1a-48ca-59f4-a3ed-633501d84726", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:e70bdd17-fa02-502d-b277-2e8f99e73276", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 6.0.1-tuxcare.9 of @angular/bazel. already_fixed \u2014 The target Angular repository at commit 931c74c227 already contains a fix for CVE-2026-50555. The fix is implemented as a postinstall patch (tools/postinstall-patches.js) that explicitly addresses this CVE by adding an escapeMatchingClosingTag function to domino's serialization logic, preventing XSS attacks via malicious closing tags in NOSCRIPT elements during SSR.", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:40119305-c4b5-50df-9750-8a1896f84347", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:cd461d0b-26b7-5780-bca2-a01c70b7e16b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:293a3c04-f0c7-543f-9053-4e9290d469ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 6.0.1-tuxcare.9 of @angular/bazel. not_affected \u2014 Angular version 6.0.1-tuxcare.3 is NOT affected by CVE-2026-54264. The service worker's AssetGroup explicitly drops all request headers before fetching assets, preventing any credentials from being sent to any server (cross-origin or otherwise). The vulnerability pattern requires header preservation across redirects, but this version never preserves headers in the first place.", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:f5b9f5f9-9b31-5c5c-aa7b-790bc3686e08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 6.0.1-tuxcare.9 of @angular/bazel. not_affected \u2014 Angular 6.0.1-tuxcare.3 uses View Engine, not Ivy. The vulnerability (CVE-2026-54265) is specific to Ivy's TwoWayProperty operation in the template pipeline, which does not exist in View Engine. Two-way bindings in View Engine are processed through the same parsePropertyBinding() code path as one-way bindings and receive identical schema-derived sanitization.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:cf9c8c6b-7a85-5ae9-b958-5ef5dd876583", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:34b34aed-be45-59dc-9388-116654abbfff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:0d41d44b-e356-5a02-86c8-8fd515f7d9f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.0.1-tuxcare.9 of @angular/bazel. not_affected \u2014 Angular 6.0.1 is not affected by CVE-2026-88056. The vulnerability requires Angular's URL resolution to use String.prototype.trim(), which strips Unicode whitespace and creates a discrepancy with WHATWG URL parsing. In version 6.0.1, the vulnerable code path (url.ts with urlStr.trim()) does not exist. The parseUrl function in location.ts and HttpRequest constructor both preserve URLs without tr...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:ff535b21-43ef-59e3-b0b9-2c2becae6a90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:d1a2120b-4b09-5931-ac46-93606299b75d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ], "bom-ref": "urn:uuid:2de74f25-4d60-5329-9efd-a1a06ca78143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 6.0.1-tuxcare.9 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@6.0.1-tuxcare.9" } ] }