{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fc14ffa9-2b6b-54f0-9cdf-7e334155dbe9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8", "version": "17.1.0-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:b2f5879d-1699-5cd2-ab7e-3aa6ea9aa2a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:a99ca1c8-83b3-52a6-9e76-59bf5f8eafbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:8e3e3644-6547-5a65-9bd6-b2c86a627b56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:033671ba-2857-500d-93d6-b9de4ceb4eea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:9c46b33f-52f5-5465-b397-85735dfa4fa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:bbac4af7-501f-55b2-93f9-a193c2136d1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:f8438468-51b4-5366-92fd-cbb9303c4990", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:4138a70d-e4b3-5254-8da9-53c5cf57569b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:55d0e2c9-7a8a-5245-aafc-aed8795ad010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:2f7e1229-c5bc-5810-a2d9-2f4ee5eb21e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:b9f9488a-398c-5c2a-8fb3-24b8d6009fc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:c3408644-3656-5850-8ab1-5e842eca7b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:f9a2672a-265a-5195-8281-69b2e0dd9385", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:9a9ec34b-57b7-50b6-9f2d-7b2f4ab06f4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:d5b67c2e-5282-5304-9765-cdb28b445f71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:b40f8e85-c185-59ab-a2a6-d95b479e431e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:44785a05-dae2-562d-a299-6124f27fbb90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:7e60644a-56ff-50aa-906f-c7d52aa0547f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:15457c94-b02a-5510-a3bc-1e43ecf17542", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:dab92932-d854-54ae-950b-634d601f04d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:de8f2b48-5516-5d87-be8a-6a6081fa2691", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:6e635b0e-ccba-54f1-9eb3-38f9ea30013b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:e5088988-d544-56ac-82bc-aee62436ad74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:2c94ef27-8a89-5800-bc3e-952bb8b93fce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:8f681f4d-d7a2-5d5a-8508-9f472cfcc073", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:a9843a3b-f60e-5939-92aa-0ddbdbae39cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:dbec937c-bf1f-5f44-81c2-beab7d2faeaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:a4383f97-5896-5827-aa3b-3cdf400750c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:0efd6fd1-9c59-5100-819a-6a4b423a29e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:2a8022f8-da9b-5ce6-8356-84e779b13551", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 17.1.0-tuxcare.8 of @angular/language-service. not_affected \u2014 The Angular repository (version 17.1.0-tuxcare.5 at SHA 1b802ce320) is not affected by CVE-2026-88058 because it does not contain the vulnerable source code. The vulnerability exists in the domino library's HTML serialization code (lib/NodeUtils.js), which Angular references as a dependency in package.json but does not vendor. The upstream patch (89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef) is a D...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:30773ce6-34ab-5024-870d-d78115f0b4de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ], "bom-ref": "urn:uuid:a4e78995-a01e-51dd-ac74-e5b20c66efea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.1.0-tuxcare.8 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.8" } ] }