{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8530b90b-bec3-525f-9aa5-9c47bfa633db",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/core",
      "purl": "pkg:npm/%40angular/core@19.2.23-tuxcare.5",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5",
      "version": "19.2.23-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/core",
            "purl": "pkg:npm/%40angular/core@19.2.23",
            "type": "library",
            "version": "19.2.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-4231",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:23806e68-5028-52b1-8caf-4f253b6a5af3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-4231 does not affect version 19.2.23-tuxcare.5 of @angular/core. not_affected \u2014 Angular v19.2.23 is not affected by CVE-2021-4231. The vulnerability concerns XSS through unescaped HTML comment content. The fix (escapeCommentText function) was introduced by upstream Google Angular in December 2020 (commit 47d9b6d72d) and is present in this version. The fix was already in the upstream release when TuxCare onboarded version 19.x, making this an upstream-fixed case, not a TuxC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:638ffca7-c200-5dd6-aa1d-23b644b20283",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22610 affects version 19.2.23-tuxcare.5 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:ef01280e-4c53-5b56-b665-f1485e47d2bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.23-tuxcare.5 of @angular/core. already_fixed \u2014 The target repository (Angular 19.2.23) already contains the fix for CVE-2026-27970. The vulnerability patch was applied via TuxCare backport commit 1d55ab497ceebdc7624f3357deac1d4c9c30171a on July 1, 2026, two days before the target version SHA (July 3, 2026). The fix converts ICU message attribute handling from implicit trust to explicit allowlist validation, blocks all URI attributes with 'u...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32635",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:21e9c075-3a6b-501c-bed9-4bbfd0d4b529",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32635 affects version 19.2.23-tuxcare.5 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:14f8f398-bf9e-582c-b668-e70585f99a5a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50557 does not affect version 19.2.23-tuxcare.5 of @angular/core. not_affected \u2014 The target version 19.2.23-tuxcare.7 is NOT AFFECTED by CVE-2026-50557. Both components of the vulnerability fix were shipped in the upstream Angular 19.2.23 release (cut 2026-05-27) before TuxCare onboarded it (2026-08-11). The fix includes: (1) proper identification of namespaced script elements like ':svg:script' in the template preparser, and (2) consistent security context schema mappings ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:cbb561ec-268f-5db2-b3a1-7d85f018598c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-52725 does not affect version 19.2.23-tuxcare.5 of @angular/core. not_affected \u2014 CVE-2026-52725 is NOT present in Angular 19.2.23. The vulnerability (allowing dynamic component mounting on <script> tags) was fixed by upstream Angular before the 19.2.23 release. The fix validates the host element in locateHostElement() and rejects script tags, throwing RuntimeError UNSAFE_VALUE_IN_SCRIPT. This upstream fix was already present when TuxCare onboarded version 19.2.23.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f62a3a5f-fb74-5fef-899c-9751174dc9ff",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.23-tuxcare.5 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:73c95d25-50b2-5a0a-917f-ef2644dbe3e8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.23-tuxcare.5 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:66d36277-350d-5d77-943f-7cfe77a63ef3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88057 is fixed in version 19.2.23-tuxcare.5 of @angular/core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/core@19.2.23-tuxcare.5"
    }
  ]
}