{
  "@id": "urn:uuid:c045abc0-eb2e-42d7-bc14-653e7d83164b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:22:36.374927+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-29T18:29:51.220655+00:00",
      "status_notes": "Vulnerability CVE-2025-59052 affects version 14.2.8 of @angular/platform-server.",
      "vulnerability": {
        "name": "CVE-2025-59052"
      },
      "action_statement": "Vulnerability CVE-2025-59052 affects version 14.2.8 of @angular/platform-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      },
      "action_statement": "Vulnerability CVE-2026-101895 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-20T14:42:09.335337+00:00",
      "status_notes": "Vulnerability CVE-2026-111754 affects version 14.2.8 of @angular/platform-server.",
      "vulnerability": {
        "name": "CVE-2026-111754"
      },
      "action_statement": "Vulnerability CVE-2026-111754 affects version 14.2.8 of @angular/platform-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-41423 does not affect version 14.2.8 of @angular/platform-server. not_affected \u2014 The target repository (Angular 14.2.8-tuxcare.1) is NOT affected by CVE-2026-41423. While the vulnerability pattern exists in newer Angular versions that use the WHATWG URL constructor, the target uses Node.js's legacy url.parse() API which does not interpret protocol-relative URLs (//evil.com) or backslash-prefixed URLs (/\\evil.com) as hostname overrides. This architectural difference prevents...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41423"
      },
      "impact_statement": "not_affected \u2014 The target repository (Angular 14.2.8-tuxcare.1) is NOT affected by CVE-2026-41423. While the vulnerability pattern exists in newer Angular versions that use the WHATWG URL constructor, the target uses Node.js's legacy url.parse() API which does not interpret protocol-relative URLs (//evil.com) or backslash-prefixed URLs (/\\evil.com) as hostname overrides. This architectural difference prevents..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      },
      "action_statement": "Vulnerability CVE-2026-46417 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      },
      "action_statement": "Vulnerability CVE-2026-50168 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 does not affect version 14.2.8 of @angular/platform-server. already_fixed \u2014 The target repository (Angular 14.2.8-tuxcare.1) already contains the CVE-2026-50555 fix via its postinstall-patches.js script. The script patches the domino dependency to add NOSCRIPT to the hasRawContent object and route its text content through escapeMatchingClosingTag(), matching the upstream fix from commit f74cccd496283b6141fbdbeb25b168f4b1c9836a. This prevents XSS via premature NOSCRIPT ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50555"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Angular 14.2.8-tuxcare.1) already contains the CVE-2026-50555 fix via its postinstall-patches.js script. The script patches the domino dependency to add NOSCRIPT to the hasRawContent object and route its text content through escapeMatchingClosingTag(), matching the upstream fix from commit f74cccd496283b6141fbdbeb25b168f4b1c9836a. This prevents XSS via premature NOSCRIPT ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 does not affect version 14.2.8 of @angular/platform-server. already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 146-197) and will be automatically applied to the domino dependency during package installation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50556"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-50556 has already been fixed in the target repository. The fix is present in tools/postinstall-patches.js (lines 146-197) and will be automatically applied to the domino dependency during package installation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      },
      "action_statement": "Vulnerability CVE-2026-69149 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 14.2.8 of @angular/platform-server. not_affected \u2014 Angular version 14.2.8 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in the `parseUrl` function that strips Unicode whitespace, converting validated same-origin URLs into cross-origin protocol-relative URLs. This vulnerable code pattern was introduced in Angular v20+ during a \"clean up and simplify url resolution utility\" refactor. Version 14.2.8...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular version 14.2.8 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in the `parseUrl` function that strips Unicode whitespace, converting validated same-origin URLs into cross-origin protocol-relative URLs. This vulnerable code pattern was introduced in Angular v20+ during a \"clean up and simplify url resolution utility\" refactor. Version 14.2.8..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      },
      "action_statement": "Vulnerability CVE-2026-88058 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/platform-server@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/platform-server@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-19T03:17:00.158398+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      },
      "action_statement": "Vulnerability CVE-2026-88060 affects version 14.2.8 of @angular/platform-server, and is fixed in 14.2.8-tuxcare.6."
    }
  ]
}