{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fa2df747-c1f4-5f44-8877-3a01e21e0225", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5", "version": "5.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:29cc1f14-6d30-59b1-80a1-b5c539e876b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:36d5d655-17e7-5f37-9b80-c50b37089f52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.9." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4af36453-7e10-54a4-aa19-5b03bfbb9e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:bed5cd5a-6e29-5570-9630-2a3f41d907b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:123e4959-2f30-5173-a835-ec00fd3b2484", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:638003e2-d536-5b25-9523-882044cdff06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f5df9c78-6fb1-5327-916b-cde658ebda05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:dabf2d34-6c73-5375-ab4c-76506f82aff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:06b09a9a-0539-597e-b89b-b537b26d4227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ac906c0b-ba43-5e60-b1e4-ab7abd636b57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9f1b3093-72d9-5166-8c71-d6bbc14f41ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:54d0b2d6-b3bd-522c-9006-7c3dec44cf77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0a7d01e0-54a5-575b-af76-86d757008bf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8012b2a6-a074-507e-a4ca-4ff84eed637b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:063ad1e6-f6a7-5f1f-bf4c-7ae92191ec75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:36a7967d-d647-56eb-836d-47ee74db5cff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9ac71f80-4b4f-53e3-8a9d-468a3d319aff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:8db94aa2-ac76-558d-82a7-bdfd548b4d0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c5c104ab-d315-5a49-97d0-f835f254a25a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0ad587c9-4a50-55f6-b444-4d11ae0405bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.8." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:45db3c42-5153-55ae-af1e-48386078b19a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:124ad38d-13c4-5bdf-92fe-45508377c01d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5610c318-2ee5-5ca0-a682-ca2f5074cd00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 5.2.11-tuxcare.5 of @angular/language-service, and is fixed in 5.2.11-tuxcare.13." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:52df241b-af76-56f3-a914-1f677a382a4c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c21acaae-fdf6-5214-8c5e-5f8d7b1462af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:44b652b6-a892-55f7-8787-c280c24db548", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:90a49c53-9260-5577-b2bb-8e9b2db27023", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.5 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@5.2.11-tuxcare.5" } ] }