{
  "@id": "urn:uuid:142d24d4-1185-42e5-8b6b-3cdcfcd1a0a1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2025-66412 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-66412"
      },
      "action_statement": "Vulnerability CVE-2025-66412 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 12.2.16 of @angular/elements.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 12.2.16 of @angular/elements."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "action_statement": "Vulnerability CVE-2026-41423 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      },
      "action_statement": "Vulnerability CVE-2026-50169 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      },
      "action_statement": "Vulnerability CVE-2026-50184 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "action_statement": "Vulnerability CVE-2026-50555 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "action_statement": "Vulnerability CVE-2026-50556 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 does not affect version 12.2.16 of @angular/elements. not_affected \u2014 Angular 12.2.16-tuxcare.2 is NOT affected by CVE-2026-54264. The vulnerable code pattern does not exist in this version. The service worker creates fresh requests using only the redirect URL without copying any headers from the original request, preventing credential leakage to third-party origins on cross-origin redirects.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54264"
      },
      "impact_statement": "not_affected \u2014 Angular 12.2.16-tuxcare.2 is NOT affected by CVE-2026-54264. The vulnerable code pattern does not exist in this version. The service worker creates fresh requests using only the redirect URL without copying any headers from the original request, preventing credential leakage to third-party origins on cross-origin redirects."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-54265 does not affect version 12.2.16 of @angular/elements. not_affected \u2014 Angular 12.2.16 is not affected by CVE-2026-54265. The vulnerability exists in Angular's modern template pipeline compiler architecture (introduced in Angular 16+) where TwoWayProperty IR operations bypassed sanitizer resolution. Angular 12.2.16 uses the older architecture where two-way bindings are desugared into separate property and event bindings, and the property binding inherently goes th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54265"
      },
      "impact_statement": "not_affected \u2014 Angular 12.2.16 is not affected by CVE-2026-54265. The vulnerability exists in Angular's modern template pipeline compiler architecture (introduced in Angular 16+) where TwoWayProperty IR operations bypassed sanitizer resolution. Angular 12.2.16 uses the older architecture where two-way bindings are desugared into separate property and event bindings, and the property binding inherently goes th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 12.2.16 of @angular/elements. not_affected \u2014 Angular v12.2.16-tuxcare.4 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in the parseUrl function that strips Unicode whitespace, converting same-origin validated URLs into cross-origin protocol-relative URLs. This vulnerable code pattern was introduced in Angular v22.x (May 2026) via commit 6e71049021, over 4 years after v12.2.16 was released (J...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular v12.2.16-tuxcare.4 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in the parseUrl function that strips Unicode whitespace, converting same-origin validated URLs into cross-origin protocol-relative URLs. This vulnerable code pattern was introduced in Angular v22.x (May 2026) via commit 6e71049021, over 4 years after v12.2.16 was released (J..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/elements@12.2.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/elements@12.2.16"
          }
        }
      ],
      "timestamp": "2026-10-18T21:00:13.385112+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 12.2.16 of @angular/elements, and is fixed in 12.2.16-tuxcare.6."
    }
  ]
}