{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f3171e17-7059-515d-bf3a-87cd2f03103f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1", "version": "17.3.12-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:cc2ee4fb-e781-5ec3-b802-c5642710c8bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:1d2c7b17-9eb3-5111-a8e5-5d0e67b3b730", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:82ac4ccf-9214-54ce-91a8-a0648e3fe79b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:329b0cde-69ee-593a-a745-81dff77f8050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:834d8c5c-8c5a-50b8-b8ce-dfae5eb3160d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:66a06c4d-03a8-5a6f-9f42-f5bff04e4b4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:ff4032e3-a1c1-57f0-b562-7fe5612161cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:b9b22dcf-c9dc-52f7-b01c-aada94e2b7c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:992933c3-d793-5a1f-838a-c65f35b76729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:72b4f281-a2a6-51d2-90a6-040463c8e341", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:48de2892-3fb8-54b7-80e1-27bb33990ccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:5b7d1129-eda4-53ab-8135-7c935e841c29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:6be646f3-35bf-53f4-879c-605e704c213d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:ca415a89-dbbc-5d9f-bd86-0f3668dbbf8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:11559402-9244-53d2-a1eb-cb96daf5baec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:7a3a6325-65c1-5d14-a7b0-51906c202fda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3239d753-9ff6-503f-92f5-c4c976cf646b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:b9236e4d-afd9-5208-bff2-8de94000baa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:e19127a2-0c29-5efc-bf86-0613f2cf6adc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:978c2eb8-ba0e-54a4-9600-d98ea5a9cc8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:df238cf1-6640-56d2-8729-aa919fbe8428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:e4c8716c-b1f6-565d-b2aa-eedc64819849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:758b3998-9be1-5d53-b429-bab0339e7c42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:5a28f9c2-afbb-5e2c-9000-966e1679911d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.1 of @angular/language-service, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:eeb7e108-e4c8-50c1-92a0-b2a693d40eb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.1 of @angular/language-service. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:bad00ee2-bc8b-5cc8-82c5-3f36264c3df2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.1 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:97681d45-4730-5e91-9fd3-448af6a72ffb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.1 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8271c670-1d4d-5dc5-bb26-43e896ba107d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.1 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@17.3.12-tuxcare.1" } ] }