{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:00b31bf6-31a1-5fa5-8dde-81764952e60e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8", "version": "18.1.2-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:fc0af09f-d578-50e0-8c6e-92794910e600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a0cf03a3-8812-5cc9-bd45-48c38ff6a966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:34a16129-4266-56ef-a4a4-8eddda0b2f7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:62b8e678-d5d5-5248-934e-877f32517379", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:76f7108f-f574-54ad-8851-793c66e3d8dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:66ed8279-8938-5d2f-8361-67c294a4aec7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a245c339-108c-5a9a-8ccd-250d8a6435c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:56a7f14d-6fe7-57b1-aa0d-583dd39ee215", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:e943ccc2-0039-5166-96c5-caf5d637236f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:dd267b41-67dd-56f4-b180-0ad21583e1df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:44c42988-3aa8-523e-a192-97b96f1d334c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:564f1688-2f8c-58e7-801b-8c73f89e125c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d55a8630-ec13-513a-bb33-1c9c1f6dd7eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:03007194-7033-5017-89b8-6082488ba4de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:80cbe8ec-baf8-570d-8ff9-a75b121d381c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:419ef964-6c1f-5925-93db-ab0315e02ca9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50555 does not affect version 18.1.2-tuxcare.8 of @angular/language-service. already_fixed \u2014 The target Angular 18.1.2 repository has already been patched for this vulnerability. TuxCare commit 32991dd728 'fix all CVEs' added a cumulative domino patch that fixes both the NOSCRIPT XSS vulnerability (CVE-2026-50556, corresponding to the provided patch f74cccd) and the astral Unicode index bug (CVE-2026-50555). The patch is applied automatically to the domino dependency via patch-package ...", "justification": "code_not_present" } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:77cc8bbe-abb1-547d-bbd7-b5ca5b4d4318", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 18.1.2-tuxcare.8 of @angular/language-service. already_fixed \u2014 CVE-2026-50556 (XSS via noscript raw-text serialization in domino) has been fixed in this Angular repository. The fix is present in tools/esm-interop/patches/npm/domino+2.1.6.patch and is automatically applied to the domino dependency during installation via the postinstall script. The patch was added by TuxCare in commit 32991dd728 on 2026-07-01.", "justification": "code_not_present" } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a2407e30-0342-5c34-9421-cd84606e885a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:64825e5c-11e9-5cd6-8d5a-cd140e8892ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:37068bb2-8a7e-5174-970c-65614bbff66c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:81197e06-7151-5786-bff6-1312c9ee10e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:e9c0809c-1bb3-5d80-9532-e9c6ada4a819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:2733956e-b150-53fc-89c1-84082829b86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:d0b3085a-67e4-591e-a320-881858b368cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:7138defe-26a9-5696-86e1-d1b769d993d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:941c1db3-8910-5508-abd0-5b9d3077cee1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:01446adc-cbd4-5e13-b205-23cd5d89af3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:b6f91590-ef85-5e28-9f1b-6ab05583a1d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 18.1.2-tuxcare.8 of @angular/language-service. not_affected \u2014 The target version (Angular 18.1.2) does NOT contain the vulnerable code pattern. CVE-2026-88056 describes a Unicode whitespace trimming vulnerability in Angular SSR's URL resolution, where `String.prototype.trim()` strips characters like U+00A0, converting same-origin paths into protocol-relative cross-origin URLs. The vulnerability was introduced in Angular v20.x during a refactoring (commit ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:08a83940-284a-5519-a608-c31222b25b9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:a93369b8-9a03-51d7-8831-09213e59f6aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:e17f213f-9207-5545-8254-d629a5ea391f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ], "bom-ref": "urn:uuid:3651eef2-7426-52fb-9903-a141171d5533", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 18.1.2-tuxcare.8 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@18.1.2-tuxcare.8" } ] }