{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2260c6c1-6a75-507f-ab9b-2466dec0a8af", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:35017a64-87a0-5c18-995a-50134e47729d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3dcf73ba-4a8b-5076-b859-4525d3f8fa2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f3476ab3-c847-5974-96ae-a2f1cc6dea30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5c3a80a6-edd6-5336-bb80-178f1c359cee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0254785c-57e0-5cc1-b79e-5e3eef3f57c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:555ef7d8-7e04-5ce6-9296-8fa3f9cf7b15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9ba87c4d-021a-5854-b787-6c63084b8b72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:58c1f548-b4ef-51fb-87b0-8c172028d5b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:915daa07-5cd3-56f4-bd4e-0bd4d5e05260", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:eebedb3e-dce1-542a-9087-b08dbdd3b600", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a6178145-50f4-587e-8cdd-8c7735469067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:cfcbad5a-9df3-570d-ae70-4b381cfa0b8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:753c6e32-cc2b-5f69-b9e3-b32f85d3b42a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7100c5fd-378f-5f1b-997b-acb3d74d717d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:22e8bf63-8c0a-5bf7-be66-997af16cd6b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:24f54283-ff1d-556f-8a2b-24278076ec17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:84269366-f584-57d7-8767-f8c57a39629b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8ecda6d0-d78b-5e27-abd8-55245380741d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:97b84317-b1c6-593e-91a7-5a7944e55b97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:22ebcc8c-d2af-5e1d-a443-61e012e29222", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:13ab8880-6f24-5a0a-b9b4-d75a8a7401c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:bb1d968d-726c-56cb-87b9-dfc97ed23500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fa92b600-a7f7-57c1-b576-1628808077d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:78ddf955-0eb7-5bfa-94bb-507c83d4bb13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:6c775f7e-c97d-5062-91b6-f5ef888ab4cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fea127f0-6083-5bad-87f7-a484a491b6ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/language-service. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:44e9435e-d65b-59aa-a98c-b9efd5addd94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9a5684fe-fd31-5202-a2ac-3c9443c1e74a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fc24ee80-1af4-55e4-a195-013176ec6567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fe80ee8d-fc74-53ad-90d2-cc70c555a2fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@16.2.11-tuxcare.4" } ] }