{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:08625c1d-cb88-5305-a6b8-2e7edcc8bf32", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6", "version": "5.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4f50498c-cd54-56cc-a2f0-10c017bbcb41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:eefab076-c77d-5d2c-b239-5d7e42898adf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7ab0ece6-71bb-5883-bad1-318f7a883d7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:73ce0ea2-558b-5662-8db5-784580bcd77a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3a170a12-41cc-5585-b143-72c13db614fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a78e0343-e90e-558d-b57a-48fd98faaebf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5f710998-094e-52c7-a3c3-4f78dbc20c6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:07c77f7d-6866-505b-b3bb-30eec239f591", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dcd54888-2b17-5c41-9ec0-12c0b822b0fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:943867ed-a717-55ee-af04-ef2d1259ea06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9bdcd8e8-43d9-531e-b737-120cdfe8c025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c501fdf6-2eb5-58eb-9f5c-4ef38fe32de1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:71934a8d-7905-59f4-aa86-e986540a860b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ea48659f-6b2d-514c-b49d-ca6a143c6769", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6b8403a5-2f8d-5da6-a5a7-32891230d0c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:41d4c4e5-3e8c-5f2e-914e-81b8d3d25359", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:085c05f0-0d26-55f3-b5a4-ac73eeccb580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9bf75798-8b9e-5ad0-b36c-8badf6e66fd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:400e24bf-5b28-530f-bec1-9e4449c26a79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:979248e6-8da3-5e55-a835-cd033a8f37e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f6d71318-c76f-5f17-b75f-625a3c689a0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.6 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4b3434c7-cbef-571e-8481-75548a20bf01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:79c281ed-483a-5705-83a0-3fbfb7736c7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.6 of @angular/language-service, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1b63080f-f258-5aab-86c5-bc9523579acd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.6 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e719f1ab-3531-57e1-a6b6-15c56fbd6ae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.6 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:389ba864-cc70-52e2-8b09-66cd7c349ed1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.6 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:94652910-ab37-5532-8098-6c69dff7a7e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.6 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.6" } ] }