{
  "@id": "urn:uuid:46f3b871-4ab9-405b-b505-49eecb40ff81",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T16:48:42.304008+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-03T15:51:00.524356+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-30T15:57:50.734473+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 6.0.1-tuxcare.3 of @angular/language-service.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 6.0.1-tuxcare.3 of @angular/language-service."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 6.0.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Target repository (Angular 6.0.1-tuxcare.3) is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API's protocol-relative URL behavior to override the base hostname. The target uses Node.js legacy url.parse() API which does not exhibit this behavior and does not extract, store, or use hostname information.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 Target repository (Angular 6.0.1-tuxcare.3) is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API's protocol-relative URL behavior to override the base hostname. The target uses Node.js legacy url.parse() API which does not exhibit this behavior and does not extract, store, or use hostname information."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 does not affect version 6.0.1-tuxcare.3 of @angular/language-service. already_fixed \u2014 The target Angular repository at commit 931c74c227 already contains a fix for CVE-2026-50555. The fix is implemented as a postinstall patch (tools/postinstall-patches.js) that explicitly addresses this CVE by adding an escapeMatchingClosingTag function to domino's serialization logic, preventing XSS attacks via malicious closing tags in NOSCRIPT elements during SSR.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "impact_statement": "already_fixed \u2014 The target Angular repository at commit 931c74c227 already contains a fix for CVE-2026-50555. The fix is implemented as a postinstall patch (tools/postinstall-patches.js) that explicitly addresses this CVE by adding an escapeMatchingClosingTag function to domino's serialization logic, preventing XSS attacks via malicious closing tags in NOSCRIPT elements during SSR."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "action_statement": "Vulnerability CVE-2026-50556 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 6.0.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular version 6.0.1-tuxcare.3 is NOT affected by CVE-2026-54264. The service worker's AssetGroup explicitly drops all request headers before fetching assets, preventing any credentials from being sent to any server (cross-origin or otherwise). The vulnerability pattern requires header preservation across redirects, but this version never preserves headers in the first place.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Angular version 6.0.1-tuxcare.3 is NOT affected by CVE-2026-54264. The service worker's AssetGroup explicitly drops all request headers before fetching assets, preventing any credentials from being sent to any server (cross-origin or otherwise). The vulnerability pattern requires header preservation across redirects, but this version never preserves headers in the first place."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 6.0.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 6.0.1 is not affected by CVE-2026-88056. The vulnerability requires Angular's URL resolution to use String.prototype.trim(), which strips Unicode whitespace and creates a discrepancy with WHATWG URL parsing. In version 6.0.1, the vulnerable code path (url.ts with urlStr.trim()) does not exist. The parseUrl function in location.ts and HttpRequest constructor both preserve URLs without tr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular 6.0.1 is not affected by CVE-2026-88056. The vulnerability requires Angular's URL resolution to use String.prototype.trim(), which strips Unicode whitespace and creates a discrepancy with WHATWG URL parsing. In version 6.0.1, the vulnerable code path (url.ts with urlStr.trim()) does not exist. The parseUrl function in location.ts and HttpRequest constructor both preserve URLs without tr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-26T23:47:00.100082+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:npm/%40angular/language-service@6.0.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-26T23:47:00.100082+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 6.0.1-tuxcare.3 of @angular/language-service, and is fixed in 6.0.1-tuxcare.6."
    }
  ]
}