{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8519a389-1ecd-534a-8da5-21580c3d456b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18", "version": "17.3.12-tuxcare.18", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:1fddc9dc-778a-5fb6-b39b-cfc26395aa86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:f38c1a1e-c3bd-5ea8-995a-7a404c555e05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:463492a8-e3fe-5845-b270-7aca1ed31688", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:bd589f81-3a04-5379-b655-bcf190fe68c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:6203a7fc-c36b-5e54-8a4b-6df7047a0103", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:f926cacc-8d37-5160-950d-fac69869238f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:c9025ea4-506f-5185-9675-a107e22f34d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:3fd8f2c4-54e9-5a5c-b93c-ed4223cc14f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:b2c328fe-a807-53da-98f7-fc06a7d9f963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:1fb9bd7b-e561-5359-b268-1053a23fec23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:e0006fca-c19f-59f0-b607-c84d061298e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:c9210bec-a75b-5ec9-98f4-2c1850ada3fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:2a78358d-bc30-572f-97f7-a691a77b4646", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:3298da2f-3997-526e-afa2-9218de9624f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:7082d953-bed1-5d9d-bc8f-3e3308cf37c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:36435a8a-a71f-5eff-b390-04f56160ca4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:506c01fd-673b-5bbd-ad76-402c6f5e6051", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:4d63e277-5fdf-5d52-8769-bb82510d1755", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:5b93cdc2-4709-5ec5-a92b-59d74f606893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:1a849b86-067f-5998-a3f2-0511986af00c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:3993f92b-c5f0-5e28-b992-df1e6874444d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:b7910ecf-1673-58c5-bad2-700316902711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:3c87f40f-4f8e-5d0d-8e66-cf44e3ff6b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:28a43604-cada-513f-a486-ff2f1631fd0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:c9e2561d-77a4-57eb-97a6-c993e422c47e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:423abd47-35ba-58f2-8b44-82e7c93831d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:34c5d6cf-cf0e-5f0e-b1df-dfb7504f2980", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.18 of @angular/language-service. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:257c89c8-13b2-5f2d-8364-f48437d0aa97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:96c7cd83-1de5-5827-8101-6b14ca01f389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:4f0d266d-f54d-55e1-abfa-a717eda3e971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ], "bom-ref": "urn:uuid:948cea1d-e4ad-5796-a513-b99fc764c9d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.18 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.18" } ] }