{
  "@id": "urn:uuid:ae2a1e0e-e8cb-4bd6-9fec-2bcf19c29d51",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-10-23T14:23:41.038401+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-30T15:57:50.734473+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 10.1.0 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 10.1.0 of @angular/language-service."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 10.1.0 of @angular/language-service. not_affected \u2014 Version 10.1.0 uses Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) or backslash-prefixed URLs (/\\host) in a way that allows hostname hijacking. The SSRF vulnerability only manifests when using the WHATWG URL API (new URL()) without protection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 Version 10.1.0 uses Node.js legacy url.parse() API which does not parse protocol-relative URLs (//host) or backslash-prefixed URLs (/\\host) in a way that allows hostname hijacking. The SSRF vulnerability only manifests when using the WHATWG URL API (new URL()) without protection."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 does not affect version 10.1.0 of @angular/language-service. already_fixed \u2014 CVE-2026-50555 has been addressed in this Angular repository through a TuxCare backport (commit 72e33f04a7, June 30 2026). The fix patches the domino dependency via postinstall script to escape closing tag patterns in noscript elements, preventing XSS via breakout injection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-50555 has been addressed in this Angular repository through a TuxCare backport (commit 72e33f04a7, June 30 2026). The fix patches the domino dependency via postinstall script to escape closing tag patterns in noscript elements, preventing XSS via breakout injection."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 does not affect version 10.1.0 of @angular/language-service. already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 104-142) and was committed on 2026-07-01 in commit 138c554f9d. The target applies the exact same fix as the upstream patch f74cccd496283b6141fbdbeb25b168f4b1c9836a via a postinstall script that patches the domino dependency.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 104-142) and was committed on 2026-07-01 in commit 138c554f9d. The target applies the exact same fix as the upstream patch f74cccd496283b6141fbdbeb25b168f4b1c9836a via a postinstall script that patches the domino dependency."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 10.1.0 of @angular/language-service. not_affected \u2014 Angular 10.1.0-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability requires the Service Worker to preserve and forward credential headers on cross-origin redirects. In this version, AssetGroup creates fresh requests without any headers when following redirects, and DataGroup delegates to the browser's native fetch API which correctly implements the Fetch specification's header-stripp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Angular 10.1.0-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability requires the Service Worker to preserve and forward credential headers on cross-origin redirects. In this version, AssetGroup creates fresh requests without any headers when following redirects, and DataGroup delegates to the browser's native fetch API which correctly implements the Fetch specification's header-stripp..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-10-23T14:23:28.750437+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 10.1.0 of @angular/language-service. not_affected \u2014 Angular version 10.1.0 is not affected by CVE-2026-88056. The vulnerability requires `String.prototype.trim()` to be applied to URLs before resolution, creating a mismatch between WHATWG URL validation and Angular's internal processing. Version 10.1.0's implementation does not contain this vulnerable code pattern. The `parseUrl` function in v10.1.0 passes URL strings directly to the `new URL()`...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular version 10.1.0 is not affected by CVE-2026-88056. The vulnerability requires `String.prototype.trim()` to be applied to URLs before resolution, creating a mismatch between WHATWG URL validation and Angular's internal processing. Version 10.1.0's implementation does not contain this vulnerable code pattern. The `parseUrl` function in v10.1.0 passes URL strings directly to the `new URL()`..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-10-23T14:23:41.038401+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@10.1.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@10.1.0"
          }
        }
      ],
      "timestamp": "2026-10-23T14:23:28.750437+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 10.1.0 of @angular/language-service, and is fixed in 10.1.0-tuxcare.9."
    }
  ]
}