{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:abf5e752-4b71-54d0-b79e-bde841e3af34", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6", "version": "10.1.0-tuxcare.6", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@10.1.0", "type": "library", "version": "10.1.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:b384fb44-c473-5466-9303-69627501a57d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 10.1.0-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:812d2cea-3a9c-5011-962d-3202f11ac38b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 10.1.0-tuxcare.6 of @angular/platform-server, and is fixed in 10.1.0-tuxcare.8." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:62a6417b-ce24-567b-bd98-eff9b8d68361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 10.1.0-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:b2f9e4d8-61fa-57a6-8529-0aa2d545e7a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 10.1.0-tuxcare.6 of @angular/platform-server. not_affected \u2014 Version 10.1.0 uses Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) or backslash-prefixed URLs (/\\host) in a way that allows hostname hijacking. The SSRF vulnerability only manifests when using the WHATWG URL API (new URL()) without protection.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:57b23aed-267c-5c8d-adef-f1c52b371862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 10.1.0-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:ae423326-c670-5f70-b285-23af83f00068", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 10.1.0-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:7d60174b-2ae8-5fc3-aba9-7b03a6d693d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 10.1.0-tuxcare.6 of @angular/platform-server. already_fixed \u2014 CVE-2026-50555 has been addressed in this Angular repository through a TuxCare backport (commit 72e33f04a7, June 30 2026). The fix patches the domino dependency via postinstall script to escape closing tag patterns in noscript elements, preventing XSS via breakout injection.", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:60973471-197a-57ea-90f5-5e3b449fb700", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 10.1.0-tuxcare.6 of @angular/platform-server. already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 104-142) and was committed on 2026-07-01 in commit 138c554f9d. The target applies the exact same fix as the upstream patch f74cccd496283b6141fbdbeb25b168f4b1c9836a via a postinstall script that patches the domino dependency.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:f52657dd-15bd-592c-8410-9ee292348dcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 10.1.0-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:cbe0ff94-aa2a-5718-b8c7-3e749da39f18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 10.1.0-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular version 10.1.0 is not affected by CVE-2026-88056. The vulnerability requires `String.prototype.trim()` to be applied to URLs before resolution, creating a mismatch between WHATWG URL validation and Angular's internal processing. Version 10.1.0's implementation does not contain this vulnerable code pattern. The `parseUrl` function in v10.1.0 passes URL strings directly to the `new URL()`...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:ad038480-3e02-5992-b471-0ac74c7fd445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 10.1.0-tuxcare.6 of @angular/platform-server, and is fixed in 10.1.0-tuxcare.7." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ], "bom-ref": "urn:uuid:04b63979-59c0-5e7e-8a3e-d013b610189f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 10.1.0-tuxcare.6 of @angular/platform-server, and is fixed in 10.1.0-tuxcare.7." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.6" } ] }