{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:30c080b4-362c-58d2-98d3-6d46446a59d7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5", "version": "13.3.0-tuxcare.5", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@13.3.0", "type": "library", "version": "13.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d12908bf-bac7-5a3a-b45c-3db3ec2732f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:15a4146d-aeaa-5fbd-a0cc-cb06ef7b1a24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 13.3.0-tuxcare.5 of @angular/platform-server, and is fixed in 13.3.0-tuxcare.7." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:59da7bad-e058-5aca-a22d-370e9d081761", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:672b5cf8-ac11-5ca7-bb58-e5ef67e6f2ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 13.3.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 The target repository (Angular 13.3.0-tuxcare.1) is NOT AFFECTED by CVE-2026-41423. While the target lacks the explicit sanitization that the upstream patch adds, it uses a fundamentally different URL parsing mechanism (Node's url.parse() without base URL) that does not extract hostnames from protocol-relative URLs. The architectural difference prevents the SSRF attack vector from succeeding.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8ef617f5-92ff-590a-807f-4099f7950c87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:03b2d4d2-ef0c-5a85-b18e-b1e85e94b372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5a5dcc5c-617a-56f9-aef7-52ea3a0f33e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b07b054c-9b63-559f-b717-7cfe80fdbd16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c8a82837-cc81-527f-992b-35da8446ead6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 13.3.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6dc4b996-17f5-58db-b2a5-328994664e68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 13.3.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular 13.3.0-tuxcare.4 is not affected by CVE-2026-88056. The vulnerability involves using String.prototype.trim() on URL strings to strip Unicode whitespace, which converts validated same-origin URLs into cross-origin protocol-relative URLs, enabling SSRF and credential leakage. This vulnerable code pattern was introduced in Angular versions AFTER 13.3.0 (likely v14+) and was fixed in v20.3....", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:deeeec32-02d2-5013-a547-5791f52b3987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 13.3.0-tuxcare.5 of @angular/platform-server, and is fixed in 13.3.0-tuxcare.6." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d1aa35f4-cbd3-565c-84bb-4c4f6c11b717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 13.3.0-tuxcare.5 of @angular/platform-server, and is fixed in 13.3.0-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.5" } ] }