{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fc837d71-a0c3-502c-b3c5-8c75d50ec251", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@13.3.12", "type": "library", "name": "@angular/core", "version": "13.3.12", "purl": "pkg:npm/%40angular/core@13.3.12" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e1439d11-c1a6-58c9-b3bc-73b9290f441f", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12 of @angular/core. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:cb29788e-bc53-5ce6-817e-aae9e241ac20", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12 of @angular/core. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:ab1695c8-99bb-551d-af49-dff8ba9babac", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12 of @angular/core. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:d0f08fd0-2194-5230-b5c9-bebaeba20aeb", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12 of @angular/core. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:a32b4f8d-831e-5404-be62-ff639ac03380", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 13.3.12 of @angular/core. not_affected \u2014 CVE-2026-68945 describes a cache-key collision vulnerability in Angular's HttpTransferCache feature that allows distinct HTTP requests with repeated query parameters to share cached responses during SSR. The target version (13.3.12-tuxcare.3) does not contain the HttpTransferCache feature, which was introduced in Angular 16.0.0-next.7 (commit aff1512950). Since the vulnerable component does not..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:3eb1b646-8764-597d-ac1f-b28791ab6e80", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 13.3.12 of @angular/core. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-88056. The vulnerable code pattern (String.prototype.trim() call on URLs during server-side resolution) was introduced in Angular v22.x (May 2026, commit 6e71049021) and later fixed in Aug 2026 (commit 9339a7a2de). Version 13.3.12 predates this refactor by multiple major releases and never contained the vulnerable trim() call. Both parseUrl implement..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:240170dc-9386-5cf9-a0fb-7cbda4745bf5", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 13.3.12 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:2225c379-d727-5b48-b4d7-08d703762231", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 13.3.12 of @angular/core. not_affected \u2014 Angular 13.3.12 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache (automatic HTTP request caching for SSR hydration) and hierarchical HttpClient configuration via withRequestsMadeViaParent(), both introduced in Angular v16.0.0. Angular 13 uses the legacy @NgModule-based DI system and lacks both the HttpTransferCache feature and the functional provider API (provideH..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }, { "bom-ref": "urn:uuid:77d6eaef-222e-53ad-9536-98742014d77c", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 13.3.12 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@13.3.12" } ] }