{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1a0b1ee6-84b3-57f6-961e-036d55df8731",
  "version": 1,
  "metadata": {
    "timestamp": "2026-08-06T21:51:16+02:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "generate-sbom.js",
          "group": "ngx-extended-pdf-viewer"
        }
      ]
    },
    "authors": [
      {
        "name": "Stephan Rauh",
        "email": "security@beyondjava.de"
      }
    ],
    "component": {
      "bom-ref": "pkg:npm/ngx-extended-pdf-viewer@29.0.1",
      "type": "library",
      "name": "ngx-extended-pdf-viewer",
      "version": "29.0.1",
      "description": "Embedding PDF files in your Angular application. Highly configurable viewer including the toolbar, sidebar, and all the features you're used to.",
      "purl": "pkg:npm/ngx-extended-pdf-viewer@29.0.1",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "externalReferences": [
        {
          "type": "website",
          "url": "https://pdfviewer.net"
        },
        {
          "type": "vcs",
          "url": "https://github.com/stephanrauh/ngx-extended-pdf-viewer"
        },
        {
          "type": "issue-tracker",
          "url": "https://github.com/stephanrauh/ngx-extended-pdf-viewer/issues"
        },
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/ngx-extended-pdf-viewer/-/ngx-extended-pdf-viewer-29.0.1.tgz"
        }
      ],
      "properties": [
        {
          "name": "ngx-extended-pdf-viewer:peerDependencies",
          "value": "This package declares only peerDependencies (Angular), which the consuming project resolves in its own dependency tree and its scanners already see. It has no runtime npm dependencies of its own."
        },
        {
          "name": "ngx-extended-pdf-viewer:supportedVersions",
          "value": "Only the latest published version receives security updates. See SECURITY.md."
        }
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pdfjs-bleedingEdge",
      "type": "library",
      "name": "pdfjs-dist",
      "version": "6.1.200",
      "publisher": "Mozilla Foundation",
      "scope": "required",
      "description": "Mozilla pdf.js 6.1.200, bundled in bleeding-edge/ as a patched fork (build 6.1.1164). Not installed from npm - see pedigree.",
      "purl": "pkg:npm/pdfjs-dist@6.1.200",
      "cpe": "cpe:2.3:a:mozilla:pdf.js:6.1.200:*:*:*:*:*:*:*",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "pedigree": {
        "ancestors": [
          {
            "type": "library",
            "name": "pdfjs-dist",
            "version": "6.1.200",
            "purl": "pkg:npm/pdfjs-dist@6.1.200",
            "externalReferences": [
              {
                "type": "vcs",
                "url": "https://github.com/mozilla/pdf.js/tree/v6.1.200"
              }
            ]
          }
        ],
        "commits": [
          {
            "uid": "6353acefe5007cd4899247a8c4e83cb7c9435a54",
            "url": "https://github.com/mozilla/pdf.js/commit/6353acefe5007cd4899247a8c4e83cb7c9435a54"
          },
          {
            "uid": "14922696fc0b001d328db934f4846f64391ec19d",
            "url": "https://github.com/stephanrauh/pdf.js/commit/14922696fc0b001d328db934f4846f64391ec19d"
          }
        ],
        "patches": [
          {
            "type": "cherry-pick",
            "resolves": [
              {
                "type": "security",
                "id": "CVE-2026-16633",
                "name": "Arbitrary JavaScript execution upon opening a malicious PDF",
                "description": "Upstream requires enableScripting (true by default in pdf.js) for the sandbox half of this issue; ngx-extended-pdf-viewer ships enableScripting=false by default. The XFA rich-text half is reachable whenever enableXfa is true, which IS the default here, so we do not claim the default configuration was safe. Both upstream fix commits are applied to the bundled engine. Fixed upstream in pdf.js 6.2.108; applied here by cherry-pick of 6c18df5768 and 4ea07c2431.",
                "source": {
                  "name": "GitHub Security Advisory",
                  "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j"
                },
                "references": [
                  "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
                  "https://github.com/mozilla/pdf.js/commit/6c18df5768a9cf12e725ebf12fc70e32358be1fa",
                  "https://github.com/mozilla/pdf.js/commit/4ea07c2431141fe66df3a2f53af53cc8ad854191"
                ]
              }
            ],
            "diff": {
              "url": "https://github.com/stephanrauh/pdf.js/commit/250ae2598bfcce4d55afd9589d88a3e0fec7a4bf"
            }
          }
        ],
        "notes": "The bundled engine is a fork of Mozilla pdf.js 6.1.200, maintained at https://github.com/stephanrauh/pdf.js (branch bleeding-edge, commit 14922696fc0b001d328db934f4846f64391ec19d). It carries modifications for Angular integration, marked in the sources with \"modified by ngx-extended-pdf-viewer\" comments. The version above identifies the upstream release the fork is derived from so that vulnerability matching works; it does not assert that the bundled files are byte-identical to that release. Fixes for known pdf.js vulnerabilities are picked up by merging upstream, and only the latest release of ngx-extended-pdf-viewer receives them."
      },
      "properties": [
        {
          "name": "ngx-extended-pdf-viewer:channel",
          "value": "bleedingEdge"
        },
        {
          "name": "ngx-extended-pdf-viewer:bundle",
          "value": "bleeding-edge"
        },
        {
          "name": "ngx-extended-pdf-viewer:pdfjsBuildVersion",
          "value": "6.1.1164"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkBranch",
          "value": "bleeding-edge"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkCommit",
          "value": "14922696fc0b001d328db934f4846f64391ec19d"
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/stephanrauh/pdf.js"
        },
        {
          "type": "website",
          "url": "https://github.com/mozilla/pdf.js"
        }
      ]
    },
    {
      "bom-ref": "pdfjs-stable",
      "type": "library",
      "name": "pdfjs-dist",
      "version": "6.1.200",
      "publisher": "Mozilla Foundation",
      "scope": "required",
      "description": "Mozilla pdf.js 6.1.200, bundled in assets/ as a patched fork (build 6.1.1164). Not installed from npm - see pedigree.",
      "purl": "pkg:npm/pdfjs-dist@6.1.200",
      "cpe": "cpe:2.3:a:mozilla:pdf.js:6.1.200:*:*:*:*:*:*:*",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "pedigree": {
        "ancestors": [
          {
            "type": "library",
            "name": "pdfjs-dist",
            "version": "6.1.200",
            "purl": "pkg:npm/pdfjs-dist@6.1.200",
            "externalReferences": [
              {
                "type": "vcs",
                "url": "https://github.com/mozilla/pdf.js/tree/v6.1.200"
              }
            ]
          }
        ],
        "commits": [
          {
            "uid": "6353acefe5007cd4899247a8c4e83cb7c9435a54",
            "url": "https://github.com/mozilla/pdf.js/commit/6353acefe5007cd4899247a8c4e83cb7c9435a54"
          },
          {
            "uid": "95ad784282ae10686787b477b0691f5c684bce02",
            "url": "https://github.com/stephanrauh/pdf.js/commit/95ad784282ae10686787b477b0691f5c684bce02"
          }
        ],
        "patches": [
          {
            "type": "cherry-pick",
            "resolves": [
              {
                "type": "security",
                "id": "CVE-2026-16633",
                "name": "Arbitrary JavaScript execution upon opening a malicious PDF",
                "description": "Upstream requires enableScripting (true by default in pdf.js) for the sandbox half of this issue; ngx-extended-pdf-viewer ships enableScripting=false by default. The XFA rich-text half is reachable whenever enableXfa is true, which IS the default here, so we do not claim the default configuration was safe. Both upstream fix commits are applied to the bundled engine. Fixed upstream in pdf.js 6.2.108; applied here by cherry-pick of 6c18df5768 and 4ea07c2431.",
                "source": {
                  "name": "GitHub Security Advisory",
                  "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j"
                },
                "references": [
                  "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
                  "https://github.com/mozilla/pdf.js/commit/6c18df5768a9cf12e725ebf12fc70e32358be1fa",
                  "https://github.com/mozilla/pdf.js/commit/4ea07c2431141fe66df3a2f53af53cc8ad854191"
                ]
              }
            ],
            "diff": {
              "url": "https://github.com/stephanrauh/pdf.js/commit/4801a3c254d78fac8c5b4187e249d6f290e9d7a5"
            }
          }
        ],
        "notes": "The bundled engine is a fork of Mozilla pdf.js 6.1.200, maintained at https://github.com/stephanrauh/pdf.js (branch 6.1, commit 95ad784282ae10686787b477b0691f5c684bce02). It carries modifications for Angular integration, marked in the sources with \"modified by ngx-extended-pdf-viewer\" comments. The version above identifies the upstream release the fork is derived from so that vulnerability matching works; it does not assert that the bundled files are byte-identical to that release. Fixes for known pdf.js vulnerabilities are picked up by merging upstream, and only the latest release of ngx-extended-pdf-viewer receives them."
      },
      "properties": [
        {
          "name": "ngx-extended-pdf-viewer:channel",
          "value": "stable"
        },
        {
          "name": "ngx-extended-pdf-viewer:bundle",
          "value": "assets"
        },
        {
          "name": "ngx-extended-pdf-viewer:pdfjsBuildVersion",
          "value": "6.1.1164"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkBranch",
          "value": "6.1"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkCommit",
          "value": "95ad784282ae10686787b477b0691f5c684bce02"
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/stephanrauh/pdf.js"
        },
        {
          "type": "website",
          "url": "https://github.com/mozilla/pdf.js"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/ngx-extended-pdf-viewer@29.0.1",
      "dependsOn": [
        "pdfjs-bleedingEdge",
        "pdfjs-stable"
      ]
    },
    {
      "ref": "pdfjs-bleedingEdge",
      "dependsOn": []
    },
    {
      "ref": "pdfjs-stable",
      "dependsOn": []
    }
  ]
}