{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6485d9cc-e14e-5efd-af50-b979fea0d675", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8c835c84-d9d7-5ec5-8a2a-e4c0f8dd2d81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:a39cdbfa-720c-5752-af1a-7366bbeeac7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:aa35d268-df23-568d-b47e-869efc28cae3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3e97222b-2998-5898-85a0-c2643ebcda5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:147102ef-c927-553c-8be1-ddf83454e495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e8b81127-094d-5781-a864-cef007a9f8da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:eed0c594-9872-5351-a907-6e4fdd298200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:057dda93-1871-5d30-8d4f-ba8d90f00ed7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0f32355c-94d5-580f-a085-04e2deb5e387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:fd03ad70-4820-5928-8996-6bfc64cb1743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:24538c5d-f1bf-560a-823e-be3ed1871f83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:32ef54d8-0539-58f7-82a7-dc7bacb3d870", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:e2509445-3bd9-53bc-ade6-bcc0a7a4b831", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b39afa4a-5d39-573b-b009-141d82ef57cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:63851fda-42c3-5604-b1ef-eef79e8fc57f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3172920b-1bce-5045-951f-63497f0dc652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:15caef4c-0019-5867-9ef0-b66ac09b8ffe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9e423d37-a9a3-51fc-90d5-c9fe8ac03393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0e81bd01-e0c0-5d65-87e6-a42c2a9e522a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:efacbf11-8ea2-5f16-91f4-327358a49148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:66106d4b-fb6e-5c9b-bcf9-5b7f25ffaaf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:194c623d-8fc9-5a09-9060-096caf4b8f8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c40acba0-c714-516b-b98b-7c272be4ab37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d304ff41-6e11-54d8-97d9-57c0b3d5c49e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:f0e922da-4bba-5773-99c8-f604cc49f6ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c1718504-24dc-5798-8327-66d9eafb1af8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/language-service. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:98ad2582-1f1f-5168-9aa1-acc631a17f18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8184d044-2524-54ec-93ce-e9b8fce10877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:42292bfd-1196-513f-9812-7409aa37b61a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@17.1.0-tuxcare.5" } ] }