{
  "@id": "urn:uuid:96d425ab-5da0-4e7b-adb1-b05cf0b0dcac",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T16:48:42.304008+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-03T15:29:00.129866+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T15:57:50.734473+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 5.2.7-tuxcare.1 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 5.2.7-tuxcare.1 of @angular/language-service."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 5.2.7-tuxcare.1 of @angular/language-service. not_affected \u2014 Angular version 5.2.7 is not affected by CVE-2026-41423. The vulnerability exists in later Angular versions (9+) that use the WHATWG URL API with hostname tracking. Version 5.2.7 uses Node's legacy url.parse() API and only tracks pathname/search/hash components, making the SSRF attack vector via hostname override impossible.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 Angular version 5.2.7 is not affected by CVE-2026-41423. The vulnerability exists in later Angular versions (9+) that use the WHATWG URL API with hostname tracking. Version 5.2.7 uses Node's legacy url.parse() API and only tracks pathname/search/hash components, making the SSRF attack vector via hostname override impossible."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "action_statement": "Vulnerability CVE-2026-50555 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "action_statement": "Vulnerability CVE-2026-50556 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 5.2.7-tuxcare.1 of @angular/language-service. not_affected \u2014 Angular v5.2.7 is NOT affected by CVE-2026-54264. The service worker's asset-group request reconstruction uses URL-only rebuilding via adapter.newRequest(req.url), which creates fresh Request objects with no headers from the original request. Since headers are never forwarded in the first place, there is no opportunity for sensitive headers to leak on cross-origin redirects. The vulnerable code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Angular v5.2.7 is NOT affected by CVE-2026-54264. The service worker's asset-group request reconstruction uses URL-only rebuilding via adapter.newRequest(req.url), which creates fresh Request objects with no headers from the original request. Since headers are never forwarded in the first place, there is no opportunity for sensitive headers to leak on cross-origin redirects. The vulnerable code..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 5.2.7-tuxcare.1 of @angular/language-service. not_affected \u2014 CVE-2026-88056 describes a Unicode whitespace bypass vulnerability in Angular's SSR URL resolution utility (packages/platform-server/src/url.ts parseUrl function that uses String.prototype.trim()). This vulnerable component does not exist in version 5.2.7-tuxcare.5. The url.ts module was introduced in later commits (e46f82d67e on 2026-06-25, after the current HEAD dated 2026-08-14 but on a diff...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-88056 describes a Unicode whitespace bypass vulnerability in Angular's SSR URL resolution utility (packages/platform-server/src/url.ts parseUrl function that uses String.prototype.trim()). This vulnerable component does not exist in version 5.2.7-tuxcare.5. The url.ts module was introduced in later commits (e46f82d67e on 2026-06-25, after the current HEAD dated 2026-08-14 but on a diff..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-26T23:19:00.100797+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@5.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-26T23:19:00.100797+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 5.2.7-tuxcare.1 of @angular/language-service, and is fixed in 5.2.7-tuxcare.7."
    }
  ]
}