{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:69fa7a6f-a6ee-5957-9407-6e3d0d925518", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12", "version": "4.4.7-tuxcare.12", "pedigree": { "ancestors": [ { "name": "@angular/language-service", "purl": "pkg:npm/%40angular/language-service@4.4.7", "type": "library", "version": "4.4.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:ab98c8a4-09a0-58c0-83a5-71d581b540b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 4.4.7-tuxcare.12 of @angular/language-service. not_affected \u2014 Angular v4.4.7 is NOT affected by CVE-2026-101895. The vulnerability is specific to the `domino` DOM emulation library's HTMLParser.js tokenizer state machine. Angular v4.4.7 uses `parse5` (v3.0.2) for server-side rendering HTML parsing, NOT domino. Domino was only adopted by @angular/platform-server in Angular v5+. The vulnerable code path (domino's lib/HTMLParser.js after_doctype_name_state h...", "justification": "code_not_present" } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:66c92ac2-3f49-5107-b61d-31a374a90014", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:7f4db205-e974-58d3-8a29-bbb9675dfeaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:8a6d943d-3618-5dd2-a4ed-cddaeae60a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:e4b356a4-0258-5700-a97f-6c27d0eb9d65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:69ef4564-1d3f-5ab2-aaf5-568863feda1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:d077684f-5650-5dd7-94e8-6089d371b2f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:12ef91ce-eb80-5bb6-9814-3fee34eab056", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:b3580f85-a471-5e76-8a7c-5dfe13f074da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:894e1c06-b71e-518a-b603-128efb1fc526", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:7a67651e-f2f7-5472-ae95-4e756c15873d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69149 does not affect version 4.4.7-tuxcare.12 of @angular/language-service. Angular 4.4.7 does not use domino for DOM emulation. The CVE specifically affects domino's serializer (lib/NodeUtils.js), which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.4.7 uses parse5 version 3.0.2 for HTML parsing and serialization instead. Domino was introduced to Angular approximately 6 years later in February 2023 (Angular 15+, commit 76731ae5c8). The vulnerable component (domino) is not present in this version, making it not affected by CVE-2026-69149.", "justification": "code_not_present" } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:d0e5d8ed-8b81-56be-9f2e-034fa883f076", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 4.4.7-tuxcare.12 of @angular/language-service. not_affected \u2014 Angular 4.4.7-tuxcare.10 is not affected by CVE-2026-88056. The vulnerability requires a `urlStr.trim()` call in URL resolution that strips Unicode whitespace (U+00A0, U+FEFF), converting validated same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 4.4.7. The target version uses a simple `parseUrl()` function in `location....", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:acb9aca9-b4b9-573f-8edf-23cfe8788133", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ], "bom-ref": "urn:uuid:dea33c18-eeb7-5be2-98c1-88ba89488729", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 4.4.7-tuxcare.12 of @angular/language-service." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.12" } ] }