{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ff403211-3907-54a2-a069-debba59eef9f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/language-service",
      "purl": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13",
      "version": "4.4.7-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/language-service",
            "purl": "pkg:npm/%40angular/language-service@4.4.7",
            "type": "library",
            "version": "4.4.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ec45e833-f3c7-59ff-b14f-f1bff9343604",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-101895 does not affect version 4.4.7-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular v4.4.7 is NOT affected by CVE-2026-101895. The vulnerability is specific to the `domino` DOM emulation library's HTMLParser.js tokenizer state machine. Angular v4.4.7 uses `parse5` (v3.0.2) for server-side rendering HTML parsing, NOT domino. Domino was only adopted by @angular/platform-server in Angular v5+. The vulnerable code path (domino's lib/HTMLParser.js after_doctype_name_state h...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:91726345-af68-59f3-b737-925339ec98f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:4e0c7dee-1d8c-5554-ab23-eb48d0ce24d7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:9fb884f2-e8a5-5122-97e7-0cf3c712d4cb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:fc4037cb-b566-5773-8e0a-112943b88090",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:dfcc4f6a-38ce-5755-8224-587e901ee9f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:d2e2dce9-a7ab-57d3-860c-e278cb2a72d4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:515966e3-c69b-5588-9415-bbbd56efb336",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:39ff3309-ab7c-5f44-b2ce-d494d3e5b428",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:832eb155-f9f7-5a46-93b9-f9cf1995e8d3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54264 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:6d8e6be8-e410-5b72-ac90-4b6a2cfeb5b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-69149 does not affect version 4.4.7-tuxcare.13 of @angular/language-service. Angular 4.4.7 does not use domino for DOM emulation. The CVE specifically affects domino's serializer (lib/NodeUtils.js), which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.4.7 uses parse5 version 3.0.2 for HTML parsing and serialization instead. Domino was introduced to Angular approximately 6 years later in February 2023 (Angular 15+, commit 76731ae5c8). The vulnerable component (domino) is not present in this version, making it not affected by CVE-2026-69149.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:97219744-c6b5-53ee-a708-14b2027d72a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 4.4.7-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular 4.4.7-tuxcare.10 is not affected by CVE-2026-88056. The vulnerability requires a `urlStr.trim()` call in URL resolution that strips Unicode whitespace (U+00A0, U+FEFF), converting validated same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 4.4.7. The target version uses a simple `parseUrl()` function in `location....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:064aa8f6-7d53-56c7-a336-e924ddd39af7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:656052e0-5586-5849-ba03-b5c97e0e60bc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 4.4.7-tuxcare.13 of @angular/language-service."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/language-service@4.4.7-tuxcare.13"
    }
  ]
}