{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9f9df63c-77e9-56e0-b11f-cc47cf52664b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4", "type": "library", "name": "@angular/language-service", "version": "5.1.2-tuxcare.4", "purl": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8d8e95d4-b755-5575-bc1a-23f4948fce28", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e0aa087a-e035-5cdb-baea-fae5a88baac5", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5587aeec-0995-50c4-bea8-06d40f56fe64", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1c8d70bb-0f4f-5475-bc06-20deb094c3c2", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2dde9c8f-4158-5111-9cc3-6b96e3d05e0a", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6f72f250-cf37-5542-b401-1da1de73af24", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.4 of @angular/language-service. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dbb4e90e-1198-58fd-bcfd-096dd5dbe586", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:27638ca3-bce1-5edc-b597-b2393bf3e831", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3ab682d4-b255-5fee-8f45-b9acc1ff10d0", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9c0f0a8e-4c60-5cc4-b0ee-5e5f5c1f12b3", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.4 of @angular/language-service. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2f5535ee-a9c6-5aa6-83ae-56933072f0cb", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eb0a8c0a-d34c-523f-98c5-fdcf54928199", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0f7e647b-9e5f-539e-9111-269facba080d", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e0399ed1-9ef4-53e7-8114-f63e1603e058", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:42da398d-7d9f-5247-8a8a-20d6f12d7878", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:161d2601-224c-536b-a536-e8e2cb432232", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d82c086-7e53-58c8-b9c2-9c0e97333bfa", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.4 of @angular/language-service. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d1e7505c-eb31-5958-9258-8859e10d1b9e", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.4 of @angular/language-service. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:372e6b3d-3395-5530-bba0-7b71f32c6025", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.4 of @angular/language-service. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:722891e1-e956-5394-bd1b-c1b37937256a", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d5e710c1-5c9d-5343-a121-9c54d15ad5f3", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:17521488-85ed-5c8e-9da3-f118b53a2476", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.1.2-tuxcare.4 of @angular/language-service. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-68945. The vulnerable component HttpTransferCache does not exist in this version. HttpTransferCache was introduced in Angular v16 (circa 2022), while this target is Angular 5.1.2 (2017-2018 era). Although Angular 5.1.2 has TransferState for basic SSR state transfer and HttpClient with HttpParams, it lacks the HTTP response caching mechanism during SSR t..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eb806ec7-a8f9-5155-a9a4-4317be5fecde", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a8a36e69-f64f-5ffa-ba3b-12c24fbc8a9f", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.1.2-tuxcare.4 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.1.2-tuxcare.4" } ] }