{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6ff71ebf-c769-5b56-9532-f0dda29fe8aa",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-02T22:57:03+02:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "generate-sbom.js",
          "group": "ngx-extended-pdf-viewer"
        }
      ]
    },
    "authors": [
      {
        "name": "Stephan Rauh",
        "email": "security@beyondjava.de"
      }
    ],
    "component": {
      "bom-ref": "pkg:npm/ngx-extended-pdf-viewer@30.0.0",
      "type": "library",
      "name": "ngx-extended-pdf-viewer",
      "version": "30.0.0",
      "description": "Embedding PDF files in your Angular application. Highly configurable viewer including the toolbar, sidebar, and all the features you're used to.",
      "purl": "pkg:npm/ngx-extended-pdf-viewer@30.0.0",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "externalReferences": [
        {
          "type": "website",
          "url": "https://pdfviewer.net"
        },
        {
          "type": "vcs",
          "url": "https://github.com/stephanrauh/ngx-extended-pdf-viewer"
        },
        {
          "type": "issue-tracker",
          "url": "https://github.com/stephanrauh/ngx-extended-pdf-viewer/issues"
        },
        {
          "type": "distribution",
          "url": "https://registry.npmjs.org/ngx-extended-pdf-viewer/-/ngx-extended-pdf-viewer-30.0.0.tgz"
        }
      ],
      "properties": [
        {
          "name": "ngx-extended-pdf-viewer:peerDependencies",
          "value": "This package declares only peerDependencies (Angular), which the consuming project resolves in its own dependency tree and its scanners already see. It has no runtime npm dependencies of its own."
        },
        {
          "name": "ngx-extended-pdf-viewer:supportedVersions",
          "value": "Only the latest published version receives security updates. See SECURITY.md."
        }
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pdfjs-bleedingEdge",
      "type": "library",
      "name": "pdfjs-dist",
      "version": "6.2.108",
      "publisher": "Mozilla Foundation",
      "scope": "required",
      "description": "Mozilla pdf.js 6.2.108, bundled in bleeding-edge/ as a patched fork (build 6.2.1096). Not installed from npm - see pedigree.",
      "purl": "pkg:npm/pdfjs-dist@6.2.108",
      "cpe": "cpe:2.3:a:mozilla:pdf.js:6.2.108:*:*:*:*:*:*:*",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "pedigree": {
        "ancestors": [
          {
            "type": "library",
            "name": "pdfjs-dist",
            "version": "6.2.108",
            "purl": "pkg:npm/pdfjs-dist@6.2.108",
            "externalReferences": [
              {
                "type": "vcs",
                "url": "https://github.com/mozilla/pdf.js/tree/v6.2.108"
              }
            ]
          }
        ],
        "commits": [
          {
            "uid": "0365cbde028bd92e58f2dab1bb70cd30ac7acfd7",
            "url": "https://github.com/mozilla/pdf.js/commit/0365cbde028bd92e58f2dab1bb70cd30ac7acfd7"
          },
          {
            "uid": "90d240f14a86bdcd7566ebebef91dea5bc8d730b",
            "url": "https://github.com/stephanrauh/pdf.js/commit/90d240f14a86bdcd7566ebebef91dea5bc8d730b"
          }
        ],
        "patches": [
          {
            "type": "backport",
            "resolves": [
              {
                "type": "security",
                "id": "CVE-2026-16633",
                "name": "Arbitrary JavaScript execution upon opening a malicious PDF",
                "description": "Upstream requires enableScripting (true by default in pdf.js) for the sandbox half of this issue; ngx-extended-pdf-viewer ships enableScripting=false by default. The XFA rich-text half is reachable whenever enableXfa is true, which IS the default here, so we do not claim the default configuration was safe. Both upstream fix commits are applied to the bundled engine. Fixed upstream in pdf.js 6.2.108; applied here by merge of 6c18df5768 and 4ea07c2431.",
                "source": {
                  "name": "GitHub Security Advisory",
                  "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j"
                },
                "references": [
                  "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
                  "https://github.com/mozilla/pdf.js/commit/6c18df5768a9cf12e725ebf12fc70e32358be1fa",
                  "https://github.com/mozilla/pdf.js/commit/4ea07c2431141fe66df3a2f53af53cc8ad854191"
                ]
              }
            ],
            "diff": {
              "url": "https://github.com/stephanrauh/pdf.js/commit/4ea07c2431141fe66df3a2f53af53cc8ad854191"
            }
          }
        ],
        "notes": "The bundled engine is a fork of Mozilla pdf.js 6.2.108, maintained at https://github.com/stephanrauh/pdf.js (branch bleeding-edge, commit 90d240f14a86bdcd7566ebebef91dea5bc8d730b). It carries modifications for Angular integration, marked in the sources with \"modified by ngx-extended-pdf-viewer\" comments. The version above identifies the upstream release the fork is derived from so that vulnerability matching works; it does not assert that the bundled files are byte-identical to that release. Fixes for known pdf.js vulnerabilities are picked up by merging upstream, and only the latest release of ngx-extended-pdf-viewer receives them."
      },
      "properties": [
        {
          "name": "ngx-extended-pdf-viewer:channel",
          "value": "bleedingEdge"
        },
        {
          "name": "ngx-extended-pdf-viewer:bundle",
          "value": "bleeding-edge"
        },
        {
          "name": "ngx-extended-pdf-viewer:pdfjsBuildVersion",
          "value": "6.2.1096"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkBranch",
          "value": "bleeding-edge"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkCommit",
          "value": "90d240f14a86bdcd7566ebebef91dea5bc8d730b"
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/stephanrauh/pdf.js"
        },
        {
          "type": "website",
          "url": "https://github.com/mozilla/pdf.js"
        }
      ]
    },
    {
      "bom-ref": "pdfjs-stable",
      "type": "library",
      "name": "pdfjs-dist",
      "version": "6.2.108",
      "publisher": "Mozilla Foundation",
      "scope": "required",
      "description": "Mozilla pdf.js 6.2.108, bundled in assets/ as a patched fork (build 6.2.1097). Not installed from npm - see pedigree.",
      "purl": "pkg:npm/pdfjs-dist@6.2.108",
      "cpe": "cpe:2.3:a:mozilla:pdf.js:6.2.108:*:*:*:*:*:*:*",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "pedigree": {
        "ancestors": [
          {
            "type": "library",
            "name": "pdfjs-dist",
            "version": "6.2.108",
            "purl": "pkg:npm/pdfjs-dist@6.2.108",
            "externalReferences": [
              {
                "type": "vcs",
                "url": "https://github.com/mozilla/pdf.js/tree/v6.2.108"
              }
            ]
          }
        ],
        "commits": [
          {
            "uid": "0365cbde028bd92e58f2dab1bb70cd30ac7acfd7",
            "url": "https://github.com/mozilla/pdf.js/commit/0365cbde028bd92e58f2dab1bb70cd30ac7acfd7"
          },
          {
            "uid": "0c545ef6430ccf90c69d89475ed9670d90ebdb67",
            "url": "https://github.com/stephanrauh/pdf.js/commit/0c545ef6430ccf90c69d89475ed9670d90ebdb67"
          }
        ],
        "patches": [
          {
            "type": "backport",
            "resolves": [
              {
                "type": "security",
                "id": "CVE-2026-16633",
                "name": "Arbitrary JavaScript execution upon opening a malicious PDF",
                "description": "Upstream requires enableScripting (true by default in pdf.js) for the sandbox half of this issue; ngx-extended-pdf-viewer ships enableScripting=false by default. The XFA rich-text half is reachable whenever enableXfa is true, which IS the default here, so we do not claim the default configuration was safe. Both upstream fix commits are applied to the bundled engine. Fixed upstream in pdf.js 6.2.108; applied here by merge of 6c18df5768 and 4ea07c2431.",
                "source": {
                  "name": "GitHub Security Advisory",
                  "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j"
                },
                "references": [
                  "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
                  "https://github.com/mozilla/pdf.js/commit/6c18df5768a9cf12e725ebf12fc70e32358be1fa",
                  "https://github.com/mozilla/pdf.js/commit/4ea07c2431141fe66df3a2f53af53cc8ad854191"
                ]
              }
            ],
            "diff": {
              "url": "https://github.com/stephanrauh/pdf.js/commit/4ea07c2431141fe66df3a2f53af53cc8ad854191"
            }
          }
        ],
        "notes": "The bundled engine is a fork of Mozilla pdf.js 6.2.108, maintained at https://github.com/stephanrauh/pdf.js (branch 6.2, commit 0c545ef6430ccf90c69d89475ed9670d90ebdb67). It carries modifications for Angular integration, marked in the sources with \"modified by ngx-extended-pdf-viewer\" comments. The version above identifies the upstream release the fork is derived from so that vulnerability matching works; it does not assert that the bundled files are byte-identical to that release. Fixes for known pdf.js vulnerabilities are picked up by merging upstream, and only the latest release of ngx-extended-pdf-viewer receives them."
      },
      "properties": [
        {
          "name": "ngx-extended-pdf-viewer:channel",
          "value": "stable"
        },
        {
          "name": "ngx-extended-pdf-viewer:bundle",
          "value": "assets"
        },
        {
          "name": "ngx-extended-pdf-viewer:pdfjsBuildVersion",
          "value": "6.2.1097"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkBranch",
          "value": "6.2"
        },
        {
          "name": "ngx-extended-pdf-viewer:forkCommit",
          "value": "0c545ef6430ccf90c69d89475ed9670d90ebdb67"
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/stephanrauh/pdf.js"
        },
        {
          "type": "website",
          "url": "https://github.com/mozilla/pdf.js"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/ngx-extended-pdf-viewer@30.0.0",
      "dependsOn": [
        "pdfjs-bleedingEdge",
        "pdfjs-stable"
      ]
    },
    {
      "ref": "pdfjs-bleedingEdge",
      "dependsOn": []
    },
    {
      "ref": "pdfjs-stable",
      "dependsOn": []
    }
  ]
}