{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca4487f4-fc15-5ef8-a31c-18a2390ac44c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7", "version": "18.1.2-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8d4cefab-a1c9-5192-8881-11983721c9a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:4cce3ecf-61d7-5fdf-b863-04964916fdad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:37f41179-b3d1-530d-bf48-8950cd34992d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:cf0bc581-e45a-5fae-9bb7-af6ee52feca5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 18.1.2-tuxcare.7 of @angular/language-service, and is fixed in 18.1.2-tuxcare.8." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f18db5e7-fd39-5d36-99fc-02afd29ec597", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dda63f39-ae8c-5e6f-804a-fd1eb9ab537c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dea862ad-a5be-5b17-9ade-fd29ff4b8564", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:78e0c5bb-f084-50b4-9cee-c23809b31271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dccceb37-b574-5630-b3c4-f3675dadca93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a7bc36b7-96fc-5222-b4f9-509e0ecda142", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c1a3eb43-1c60-50fc-a762-8dc78a2dfe1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:982fcc25-4695-5f8f-9276-b7d560d75b16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:4a29127e-9d96-5b65-ae9b-5eb1560f1fbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:bf55dcfa-b972-57d2-81c4-3dbf2b9af4ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9e9c0279-d22d-59b7-817e-2e12bb386423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:089de09b-f2dc-5f03-a54d-6d3140a27d86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.7 of @angular/language-service. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:605dfdef-2f68-53f3-a671-8aeb29d05c80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.7 of @angular/language-service. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:edb8b8dd-b4b9-5d7b-8d03-782a92c1896e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d4167299-4fe8-5950-87bb-ad1cc78c1fe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d1182a23-3b7b-55ca-9dcc-0db917ea811a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e3e0cb42-fc9d-5ac1-b0e6-11a51f46b463", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:ca5cdc8c-c839-5b93-b316-56aee0af0a7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:951d1c27-aba6-5c19-bee9-cac6cb6e181f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:7acb0a1d-9e5e-543e-9da7-5640f7db6ea3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0677186a-4cfb-591d-9a53-c6b58b660d3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6e79b27a-4e9a-597f-8e39-6c4e18cb46cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dcd097e5-6cc2-53f9-9f44-0fa12d5d2c1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:5e9e0962-a7e9-5569-8a92-10fff19df02b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.7 of @angular/language-service. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:53cafa10-409b-509e-9095-1031d5a8c22c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:729a0cc6-cee3-5e8a-9fe8-d0299f398b81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:143e7483-582f-5f86-8eda-aea0382dd7d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c90af953-6dc0-55cb-95ea-8fbce812b609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.7 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.7" } ] }