{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3c2310c1-f752-5187-b17b-aef3484c0eea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22", "version": "5.2.11-tuxcare.22", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:ae4ac925-9e7b-56c7-af12-c9c0a0cb5ab8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:fb05de84-ce7d-55be-8bee-e1bf597a0bb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:e07846a2-7624-569d-9cb2-20a28ce8fc8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:54877f1f-e394-5b02-9194-b39ef6e26a23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:6a13086e-1044-53a6-925a-01a8a2eb659c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:62d2d548-19a1-5376-b55a-297147afa9de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:43297ba1-008a-58ae-b079-31dcb54d0970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:80153814-854b-51a1-8397-4e81cd8a4025", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:9ccc68e1-6e62-5d48-b2e8-f25b3da14454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:7372b467-b9b4-50aa-b1dd-7aa279cd6bb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:8a65c384-7d31-5a75-99a0-6ef710c29189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:a5d38ccc-fe02-55ce-9482-1430d82a03dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:a9dbbd8f-a902-565e-98a2-a1553982981f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:a6828646-e77f-5781-92ac-cf3ac891ec6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:106a3da3-8bca-5b7f-8adb-f117f0d75cc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:2dd57650-3fe7-5f94-a134-80d1a8391798", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:015727aa-bb50-5a97-a700-6fcc6c4909d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:db336071-f163-5be5-9986-df2865bfb494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:e32a7d05-4d07-5d81-8515-b715dd12f966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:727e4848-bade-566c-ac92-a578673b4dcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:7d5af4da-92e6-544b-b2cf-23b7b9739f19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:d686fb0e-94c9-5b3b-85eb-4c4878f251e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:1db58199-3913-58f1-b882-be6a0dcb9fef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.22 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:39630b58-01d9-5a13-9bf0-af6848df5aeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:f096e50c-126e-5afc-b610-e98790d8284a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:2d096cca-6a56-5255-a802-644a744372c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.22 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:150a824e-7b8f-5a8d-99f3-bbc18fa36489", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:ef9eef8e-75b2-5b23-be29-4fd088ee3ad1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.22 of @angular/language-service. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:bed73df1-ade9-51d7-81f2-5572f27fa302", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.22 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ], "bom-ref": "urn:uuid:5031c05c-b933-5bbc-86e9-29993706f87e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.22 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.22" } ] }