{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d839a4d-5799-5e75-8a0b-2d2cc9dd89ab", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5", "version": "11.2.11-tuxcare.5", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@11.2.11", "type": "library", "version": "11.2.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:75b71b3c-a9c1-5510-85d2-3501ca2091f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b5d5d181-def3-5cf6-80ab-4c68a6e52a73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 11.2.11-tuxcare.5 of @angular/platform-server, and is fixed in 11.2.11-tuxcare.7." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ee412301-03b8-5413-b458-2b1d17c07cc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:84ff8d27-ca97-5ea7-ab6d-1abb6e461970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:715781b9-f80f-5468-9cfa-e410343f5686", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:3c4ca17b-73d4-5d39-b2b5-1040d6a283da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a5c2f9e0-6f91-53dd-8f19-3a9667ae52f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 11.2.11-tuxcare.5 of @angular/platform-server. already_fixed \u2014 CVE-2026-50555 has already been fixed in the target repository. The fix is implemented in tools/postinstall-patches.js (lines 96-139) which patches the domino dependency during installation. The fix adds NOSCRIPT to hasRawContent, removes _scripting_enabled conditionals, and implements escapeMatchingClosingTag to prevent XSS via raw-text element breakout.", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:02e74d61-d2cb-5286-819b-ebfa4be9eb68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:defdcd62-ca84-5900-afcd-8ca8aadacdea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 11.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:71abc6c4-97cd-5005-8766-1e9f8d5a137e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 11.2.11-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular 11.2.11 is not affected by CVE-2026-88056. The vulnerability was introduced in Angular 19.x when URL resolution logic was refactored to include `String.prototype.trim()`, which strips Unicode whitespace and creates a discrepancy with WHATWG URL parsing. Angular 11.x never contained this vulnerable code pattern\u2014its URL resolution directly uses WHATWG URL standard without intermediate str...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c4b1b634-fc94-5cef-8a46-526c5225ab67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 11.2.11-tuxcare.5 of @angular/platform-server, and is fixed in 11.2.11-tuxcare.6." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:6e746f1b-dfea-5ca6-b2b1-5d4ec1bc1981", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 11.2.11-tuxcare.5 of @angular/platform-server, and is fixed in 11.2.11-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@11.2.11-tuxcare.5" } ] }