{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:66928c20-b153-5d0b-b78b-fbe7b4edc021", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3", "version": "5.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0ae837ed-d0a0-591a-9afc-363fe58e9c3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.4." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7bdb1c3d-9f71-5968-bf63-efce99f345c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:bce58ed6-8c78-584a-bf2d-2b0b28d10bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.4." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0b2aa63e-6244-502b-8964-a9b12199dc0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:bb6913a1-8fed-54bd-bc92-6fa9f2ff5bf0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:34a16aeb-75de-592f-949c-d599dbef9797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:c1cd4357-4563-5607-b642-53e8ee445771", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e85ec932-ac3c-50cf-a2e7-d0c0178f0265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:b3375c1b-473a-55ce-9e19-f0ac1ee97792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8daf0dc6-8da2-5bd0-a8c1-9724b43b7af2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6833dde0-f3f9-520c-a728-08247dc598fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:28e8ef83-1a59-5ca0-bb14-5dc2adbb4aef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9185417f-b029-5111-a288-97982b8c434b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:c87dd4af-d373-50fe-bfe9-85a616c6bae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:38e2c78a-18f4-5bec-88f6-177f32ba5c14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:09e4b3f9-b746-55ea-862d-05bd361b36ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:32e2d444-4d19-56ce-ae89-86e33b2a249a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1d00e15d-9a6b-5000-8fad-7ad3cacdc985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9e5795a5-9c39-5250-86fe-48b62f39b86a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3627521d-52c9-55bc-93ab-b6130adc9a6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:0d993dc1-7df0-575c-833e-40a6d32ca68d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:34d10bb8-d017-5fcd-aca0-f94fd081c2a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:66abdd45-a4f3-568d-a139-f0e00ae90f15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.3 of @angular/language-service, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:609a4d4f-5cb1-5fa1-ba9c-848eec2ed19b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:90e05ab0-27a8-5e6d-b6ab-bd316aec5ae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.3 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:8bc3ceef-13a4-5cde-8c27-29f7b3049520", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:82eda481-8d7d-57fe-99e5-a00376eb6807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.3 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.3" } ] }