{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:de27b79c-7d0c-545e-911b-9f93196796ac", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7", "version": "10.1.0-tuxcare.7", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@10.1.0", "type": "library", "version": "10.1.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:26e979d2-0461-5141-8f48-764c7a024f9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 10.1.0-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:d6944bf0-a7cb-5d7d-b2cd-69cdff2e62cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 10.1.0-tuxcare.7 of @angular/platform-server, and is fixed in 10.1.0-tuxcare.8." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:0f3c9a0c-5bbd-5245-8747-a6dfb13edb1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 10.1.0-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:46b79524-a273-558f-bb51-c742bd5cda24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 10.1.0-tuxcare.7 of @angular/platform-server. not_affected \u2014 Version 10.1.0 uses Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) or backslash-prefixed URLs (/\\host) in a way that allows hostname hijacking. The SSRF vulnerability only manifests when using the WHATWG URL API (new URL()) without protection.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:db6fa635-0a77-518c-a673-9630c4f2fc82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 10.1.0-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:cd888d28-1d7f-54d7-80e5-56f770756064", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 10.1.0-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:b8a806ef-0695-5138-afbe-1a2cc5319757", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 10.1.0-tuxcare.7 of @angular/platform-server. already_fixed \u2014 CVE-2026-50555 has been addressed in this Angular repository through a TuxCare backport (commit 72e33f04a7, June 30 2026). The fix patches the domino dependency via postinstall script to escape closing tag patterns in noscript elements, preventing XSS via breakout injection.", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:9d4a6023-1786-5c68-812b-36694c6152b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 10.1.0-tuxcare.7 of @angular/platform-server. already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 104-142) and was committed on 2026-07-01 in commit 138c554f9d. The target applies the exact same fix as the upstream patch f74cccd496283b6141fbdbeb25b168f4b1c9836a via a postinstall script that patches the domino dependency.", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ee98ef93-0587-5388-8626-d6ec2a7d699e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 10.1.0-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:514f546d-c30a-5b81-a4f4-7b6444cf8649", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 10.1.0-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular version 10.1.0 is not affected by CVE-2026-88056. The vulnerability requires `String.prototype.trim()` to be applied to URLs before resolution, creating a mismatch between WHATWG URL validation and Angular's internal processing. Version 10.1.0's implementation does not contain this vulnerable code pattern. The `parseUrl` function in v10.1.0 passes URL strings directly to the `new URL()`...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:a1574240-8a94-506b-ba01-8b81255d179a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 10.1.0-tuxcare.7 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ], "bom-ref": "urn:uuid:ef270343-31f6-58ad-942d-af28febf6fca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 10.1.0-tuxcare.7 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@10.1.0-tuxcare.7" } ] }