{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19723c26-a0cb-510e-820f-aa2b49b9c1b6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10", "version": "6.1.10-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:ee9ffe64-e549-50ab-b4c4-2f726e653dc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:355d97de-0107-5876-bce5-f2d57b50e002", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:380807c8-e622-5688-adf9-a92691e8aa7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:167ebe39-e570-5898-afdb-478ed9bb2f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:804b50d1-b7da-5865-b7de-fad11daef89c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:4375db33-d26a-561f-99e7-625558560457", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:124f8fc1-c11f-56be-82f8-c70922bab91e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:86527dcc-16e5-51fd-ba80-4f16007e6a39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:e0264fe2-c171-5f17-abc2-55d3b005693d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:f45a62af-2af5-5140-b487-5e51f322267c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:37b4ea39-4d31-5af7-badb-9318d9fcd753", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:433d9c5a-a078-55dd-9beb-5f1d41223fb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:32957774-273d-5351-a060-8d98f7341d61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:7962d941-6c76-5373-ab7f-86dca88ad689", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:f3a6ff25-5423-5d80-a0b8-c588c5502e44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:44546fe0-939d-54b6-9c46-ced584191844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:807ac15b-b456-5682-98dd-8bf6a4011e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:26ac36eb-09b7-5b63-a56e-a392ff579ccf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:35a6eaf1-5dfc-58ee-b161-a66eeee00f09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:fefb654e-4c9f-5d0c-9671-2b48bdeb0d40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:1f2afa53-9a2c-520f-a7a2-f6d3380095d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.10 of @angular/language-service. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:b51c88bd-5f42-5534-95c1-be8ec313adcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.10 of @angular/language-service, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:8f584b35-6c2d-5f4a-aba9-ed85dac96780", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.10 of @angular/language-service, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:c73c67ac-a0bf-5a6f-88c4-d090762ad9e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.10 of @angular/language-service. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:4c0b3afb-371e-58f7-8ee3-ea49faf20cc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.10 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:77947101-6223-5c55-82ff-9c4f6e7a9b07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.10 of @angular/language-service. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ], "bom-ref": "urn:uuid:676966e4-050d-5779-b43f-b5c66048b487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.10 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@6.1.10-tuxcare.10" } ] }