{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b010dbd7-d5aa-5bc4-87ac-948dbe43af52", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16", "version": "17.3.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:788b9ee0-ca5b-557b-8047-45352f71b08b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:480f7eae-8b6e-545b-b107-940cc4842f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2dc4740b-b8c3-50b2-836f-e8c280a2714c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7eabfc79-aa39-5348-a483-5935041f8231", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 17.3.12-tuxcare.16 of @angular/language-service. not_affected \u2014 The vulnerable code (domino's lib/HTMLParser.js with the after_doctype_name_state infinite loop bug) is NOT present in this Angular source repository. Domino exists only as a declared npm dependency in package.json (line 110: \"domino\": \"https://github.com/angular/domino.git#8f228f8862540c6ccd14f76b5a1d9bb5458618af\"). The BUILD.bazel shows domino is bundled at build time from @npm//:node_modules...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2edf49b6-5cbb-5793-a179-24b10ee55679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:92d753e5-551c-5424-836b-28529cd68b9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6ad01b77-0755-5d07-86fe-64a7e9d1286b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4d6c4c6a-a3db-5c33-a009-9b02b87fee2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:f288e99b-db14-50df-b702-c77e35de1141", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:95a34729-0ded-5716-9bb2-8ed4392228f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:3840dd27-711b-5fcf-943a-fee44dc866c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8e26e273-1b31-5ec4-89e3-0ef79044c66d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:95025953-fe6d-5f01-89b5-fb77a8307162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6e9dfdbe-6f85-522c-92ec-3c358b6da9c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ce620e68-6290-5020-9054-cff2df020adb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:64b83424-30b5-50fe-bc82-3683a78f5e28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2be7f175-2661-5b76-807b-6ea864e17de4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:97dd82b2-8518-586f-bfa9-382daf247c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:de21be25-8076-560d-897d-8700e713d9f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bd967293-41c9-5d9a-99ec-5d324f59eb26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:36c3861b-9778-5861-ac40-17175e3b6fa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:32a87514-7808-5aa7-be4a-1ee230efd2ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bd7b2295-e185-5565-8133-08fb27e9265d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7a564eac-d304-579a-9186-17a0e73a129b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:70ce5a6e-7369-5dbb-95fe-4e998e59b3aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:fb808fab-4d99-53ad-9361-50301ce73be2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.16 of @angular/language-service. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d893a15b-f5aa-5095-8fe0-b9c6f31a80b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:16c62058-0507-5687-a1fc-26883103b358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:6b78b4cf-a3b9-553d-9cda-5a43352d6d49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ], "bom-ref": "urn:uuid:98dde5f1-b731-5fc8-8578-2807194b7e5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 17.3.12-tuxcare.16 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.16" } ] }