{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a1aef13d-ec1d-5a70-93d0-48cfe07f9d0c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13", "type": "library", "name": "@angular/language-service", "version": "9.1.13-tuxcare.13", "purl": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:afe86d2e-1531-53b3-98db-6b94c96ed2ba", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:be775dac-453a-5786-b635-fd365606198c", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:261adb5e-ce93-512a-a921-406a73280da3", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:6d961c2e-6794-5ac1-98f1-60c72a37ddf8", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:a6cadbd3-0afc-5886-9eaa-d513d29eff7b", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:9c99b280-99ff-54c3-89a9-ea12597eeaa9", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:05c0173b-6b6d-5231-986d-b4d11be449e4", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:4fbcf58c-a77c-5a46-8cfc-a4f996fd005f", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:6ffe8378-2d6d-5e9a-afc5-aed1a10a16d8", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:542b2f9f-4389-5dfe-91ed-1b2bab2cc594", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 9.1.13-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-50170. The vulnerability exists in Angular's HttpTransferCache feature, which was introduced in Angular v16+. This feature does not exist in v9.1.13, making the vulnerability pattern impossible to manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:27fcc006-9d87-549e-aac1-0353a89a4ab8", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:a93fcd49-6c73-5580-9a6f-ed8ac15cb0f2", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:af16a213-1968-5bad-9a2f-5c3244d39bfb", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:e8079c83-2c26-5826-be92-39870bf6d568", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:a446c8c7-2753-5cfb-8512-6231e52e37a8", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:50629371-533d-5bdf-aac0-6c86f3cda972", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:621669ec-3a05-5c54-9aba-8c29149d4708", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:67139f7c-d799-5b6b-8b27-1b3b0b763ab5", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 9.1.13-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular 9.1.13-tuxcare.9 is NOT AFFECTED by CVE-2026-54265. The vulnerability exists in newer Ivy compiler's template/pipeline architecture where TwoWayProperty operations bypass sanitizer resolution. This version uses View Engine and early render3 (Ivy) implementations where two-way bindings desugar through the same parsePropertyBinding() path as one-way bindings, ensuring identical sanitizer ..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:a7673677-68f7-5550-990e-38c2e7eeee5d", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 9.1.13-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular 9.1.13-tuxcare.9 does not contain the HttpTransferCache feature. The vulnerability CVE-2026-54266 affects the hash generation in HttpTransferCache, a feature introduced in Angular v16+. The target version (9.1.13) predates this feature by many major versions. While TransferState (generic state serialization) exists in v9, there is no HTTP caching integration that uses it. The packages/c..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:6656a6a8-a94d-50b4-9f94-0ab13e7d2e6e", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2aaf17fd-8077-5a72-8137-b84d65c1e115", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:acee9883-4cc9-514f-bac5-2c43e8498597", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 9.1.13-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature was introduced in Angular v16.0.0 (March 2023), approximately 7 major versions after v9.1.13. The target version does not contain the HttpTransferCache code, the transfer_cache.ts file, or any automatic HTTP request caching mechanism that could exhibit the cache-key ambiguity vulnerability. While v9 does..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:a2aa577d-866f-577a-bec4-f5e4398c0fc4", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:398f160c-20f8-5423-ab6a-4109421ab03c", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 9.1.13-tuxcare.13 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.13" } ] }