{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:64cf2f38-9a24-5526-9c8d-4268d2506e10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8", "version": "7.2.16-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:06811a2e-79af-500e-af2a-1ff9c5cb1882", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.16-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:4f95888d-8559-5c39-a5a2-0349db671632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:6441e3e5-b906-5b52-923b-9c8a68b9bad7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.16-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:ab176195-63b2-529e-90f5-a095476a518c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.16-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:6715db49-2bda-5664-a3cc-fb995afaa679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.16-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:7c63812a-6a5e-5b5f-a9c6-5c2c9c758791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.16-tuxcare.8 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:62b0aabc-0016-54d4-b385-bb8784950015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:ca58ae9b-3ae3-52ae-a57e-c5c65fc95f3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:cc9110ac-5a8a-53f8-b9d6-8e60677ffe91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:62b68333-6907-511c-9ae8-d2c919e5deea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:d93a298d-b6cb-553d-99b0-596a437d714a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:e3a79122-5a1a-5ef0-a7c0-f2190d1fac6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:77cdc4a3-848f-526f-9463-0172862cc6fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:5e31ce59-e95d-5c60-92aa-59bc4d12f515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:21c6ec6b-64a5-5683-a6d8-ae36932c7ff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:9dbb3ca4-f6dc-50c5-ae02-5f2e87049702", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:afe97e21-3d7f-5530-9440-6ad391f3283f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:1b837151-492f-5d2f-9f33-357be4ece879", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:fc14df0c-6624-53ce-8a0a-774f6ad8e001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:7496a46e-b5ba-51f0-9d81-7bbfd64e2a18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:2823c566-a1cf-59e3-b2b8-063d342a977c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.16-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache key generation logic that treats repeated HTTP parameters (`?role=user&role=admin`) and comma-separated values (`?role=user,admin`) as identical, causing cache key collisions. However, the HttpTransferCache feature does not exist in version 7.2.16\u2014it was introduced in Angular v16. While v7.2.1...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:91789e39-6e98-5178-b69e-ce6503fc8cce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:205b25e7-7881-58ad-853b-a2d08b96c9b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.16-tuxcare.8 of @angular/language-service, and is fixed in 7.2.16-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:a98d230f-375d-5521-b34b-d0568d8b03f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.16-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88056. The vulnerability requires a String.prototype.trim() call on URLs during server-side rendering that strips Unicode whitespace characters, converting same-origin relative URLs into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 7.2.16. The CVE describes a vulnerability introduced in later Angular versi...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:7df88647-981a-5617-a5ed-1adafbfd4863", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88057 does not affect version 7.2.16-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88057. The vulnerability exists in the Ivy compiler's template pipeline (introduced in Angular 9+), which does not exist in this version. Angular 7.2.16 uses View Engine, where the SecurityContext determination for directive host bindings correctly uses the concrete host element name (`element.name`) rather than the directive's selector. The exploitati...", "justification": "code_not_present" } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:f4832124-1404-514a-8222-4e9d76f21c08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.16-tuxcare.8 of @angular/language-service. not_affected \u2014 Angular 7.2.16 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and client hydration features that were introduced in Angular v16+. Angular 7.2.16 predates these features by approximately 7 major versions. The codebase contains only legacy TransferState (manual key-value store) and NgModule-based HttpClient (no hierarchical delegation...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ], "bom-ref": "urn:uuid:09938d9e-5069-58c6-a1a6-d455539df20c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.16-tuxcare.8 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@7.2.16-tuxcare.8" } ] }