{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b2feb0ca-ba27-53c8-a221-3dc023955b7b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/elements@10.1.0", "type": "library", "name": "@angular/elements", "version": "10.1.0", "purl": "pkg:npm/%40angular/elements@10.1.0" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5e436016-84bf-5cc2-98c3-28f5dcba6397", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Version 10.1.0 uses Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) or backslash-prefixed URLs (/\\host) in a way that allows hostname hijacking. The SSRF vulnerability only manifests when using the WHATWG URL API (new URL()) without protection." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:f55f9084-ad34-5df9-8f3a-e81fc28d7372", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular v10.1.0-tuxcare.2 is not affected by CVE-2026-50170. The vulnerability concerns the HTTP transfer cache feature which caches HTTP responses during server-side rendering (SSR) and replays them during client hydration. This feature was introduced in Angular v16+ and does not exist in v10.1.0. The target version has no transfer_cache.ts file, no transferCacheInterceptorFn, and no HTTP tran..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:7b9c41e2-bf4d-5b45-a870-520f9ae83193", "id": "CVE-2026-50555", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 10.1.0 of @angular/elements. already_fixed \u2014 CVE-2026-50555 has been addressed in this Angular repository through a TuxCare backport (commit 72e33f04a7, June 30 2026). The fix patches the domino dependency via postinstall script to escape closing tag patterns in noscript elements, preventing XSS via breakout injection." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:e7d38186-2ce2-534e-8972-0539e81310d8", "id": "CVE-2026-50556", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 10.1.0 of @angular/elements. already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 104-142) and was committed on 2026-07-01 in commit 138c554f9d. The target applies the exact same fix as the upstream patch f74cccd496283b6141fbdbeb25b168f4b1c9836a via a postinstall script that patches the domino dependency." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:675fa9e4-f732-5035-9fc7-739333003f11", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular 10.1.0-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability requires the Service Worker to preserve and forward credential headers on cross-origin redirects. In this version, AssetGroup creates fresh requests without any headers when following redirects, and DataGroup delegates to the browser's native fetch API which correctly implements the Fetch specification's header-stripp..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:a9f9f8a2-11ee-5f8b-b4af-c2f6847519fd", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular 10.1.0-tuxcare.2 is not affected by CVE-2026-54265. The vulnerability targets the Ivy template pipeline architecture (Angular 17+) where TwoWayProperty IR operations were missing from sanitizer resolution. Angular 10.1.0 uses an earlier Ivy architecture that desugars two-way bindings to regular property bindings during parsing, automatically applying schema-based sanitization. The vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:29358f3c-2749-5997-bce6-809f2c38dcab", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular 10.1.0 does not contain the HttpTransferCache feature. The vulnerability (CVE-2026-54266) is in HttpTransferCache's weak DJB2 hash function used for cache key generation, but this feature was introduced in Angular 16+ and does not exist in version 10.1.0. Type A1 (input absent): the INPUT handler (HttpTransferCache interceptor) is not present anywhere in the codebase." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:aed19047-233d-56e9-aa81-2e596870c023", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular v10.1.0 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature for caching HTTP requests during Server-Side Rendering (SSR) that was introduced in Angular v16. Version 10.1.0 predates this feature by several years - no transfer_cache.ts file exists in packages/common/http/src/, no HttpTransferCache interceptor is registered in HttpClientModule, and th..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:69d7854e-0e7b-5082-933c-83bdccd60a88", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular version 10.1.0 is not affected by CVE-2026-88056. The vulnerability requires `String.prototype.trim()` to be applied to URLs before resolution, creating a mismatch between WHATWG URL validation and Angular's internal processing. Version 10.1.0's implementation does not contain this vulnerable code pattern. The `parseUrl` function in v10.1.0 passes URL strings directly to the `new URL()`..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:09593be2-1642-5702-886a-af39e550c9a7", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 10.1.0 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:e0630603-1215-5b6e-8a45-ef234c0d7279", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 10.1.0 of @angular/elements. not_affected \u2014 Angular 10.1.0 is not affected by CVE-2026-88059. The vulnerability requires specific features introduced in Angular v16+: HttpTransferCache (automatic HTTP response caching), provideClientHydration() (SSR hydration API), and withRequestsMadeViaParent() (hierarchical HttpClient delegation). These components do not exist in Angular 10.1.0. While v10 has SSR and TransferState, it lacks the automa..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }, { "bom-ref": "urn:uuid:d8c5eccf-ee1a-5b69-9064-856996ed6015", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 10.1.0 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@10.1.0" } ] }