{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c38b64a9-3dca-580c-a2a1-5441b8f2f08a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20", "version": "5.2.11-tuxcare.20", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d55cd513-211b-53bb-8761-3d63ddccc03e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bf8c2dd3-54bb-57b3-be9b-adcb182626ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:bc108048-ae47-58f6-a0d6-5109d00e5a85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:261a8b42-d7fa-5b8f-b683-d094a486327b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:f216dcf7-9968-59e0-bd64-702ce5dd35c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:021bc2f2-bb34-5f0a-a10b-5e973cbbf32b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d55d44ce-ca16-5092-b8e9-8e4cd0b4e2a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:fc5b1032-9933-5920-af58-9988f946e27d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:e106b21d-a566-55b4-ab2e-23387bab0e8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:3321982c-c3fd-5d80-a4f6-a770826d8785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:8e023d4d-ae2d-558e-85b9-10f7d6b8d46c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:671a95d6-a6ee-597a-a1c2-43b4f43f6349", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:b5e5216e-a1ff-597f-b5f5-067a046a6f0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:28a18819-c96a-542b-87f5-cc7accb1f91a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:0c364a58-da3d-5108-91b4-a23bb8b49095", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:341cf54a-6b4d-518f-87b2-43d44ee5c50c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:9ac0bbb2-32a6-53e7-9d7f-02fa3d80ec25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:5114cfbc-3b3c-5d10-991a-8653709d48de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:679ce243-b43c-5dae-8a8a-64ecf1823115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:07510131-48c6-5dc9-9a2d-dfe9854c2871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ead0a190-d480-5f2c-b5aa-724afcd8b285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:afa16323-ddbc-594c-b086-a357802ecf80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.20 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:cd08f407-5258-5e8a-b710-6d731dc9125b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:23e8825a-8861-54e9-8acc-1dd5d839f20f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:ac5b77e6-387e-5d25-b2f3-e056132dacb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.20 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:e70f0c81-7d16-567e-ba5f-af6ca93e54e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:d2c7ace2-e44a-5540-8e74-234e06528a4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.20 of @angular/language-service. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "justification": "requires_dependency" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:7d4fd281-6195-5a32-8c15-7e680d281757", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.20 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ], "bom-ref": "urn:uuid:e0c282a8-7855-5f4b-ad4a-c570305f8949", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.20 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.20" } ] }