{ "@id": "urn:uuid:52ab1b84-ac39-44ea-9cd2-77642a9571a2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 6, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T16:22:36.374927+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-29T18:32:37.760853+00:00", "status_notes": "Vulnerability CVE-2025-59052 affects version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2025-59052" }, "action_statement": "Vulnerability CVE-2025-59052 affects version 5.2.11-tuxcare.21 of @angular/platform-server." }, { "status": "affected", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.21 of @angular/platform-server, and is fixed in 5.2.11-tuxcare.22.", "vulnerability": { "name": "CVE-2026-101895" }, "action_statement": "Vulnerability CVE-2026-101895 affects version 5.2.11-tuxcare.21 of @angular/platform-server, and is fixed in 5.2.11-tuxcare.22." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-20T15:46:00.119964+00:00", "status_notes": "Vulnerability CVE-2026-111754 does not affect version 5.2.11-tuxcare.21 of @angular/platform-server. not_affected \u2014 Angular v5.2.11 contains the underlying data flaw (parseUrl doesn't validate that normalized pathnames don't start with `//`), but lacks the exploitation mechanism present in modern Angular SSR. CVE-2026-111754 targets versions 20+/21+/22+ where @angular/ssr automatically emits HTTP redirects on router state mismatches. v5.2.11's SSR architecture predates this by many years and only provides HT...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111754" }, "impact_statement": "not_affected \u2014 Angular v5.2.11 contains the underlying data flaw (parseUrl doesn't validate that normalized pathnames don't start with `//`), but lacks the exploitation mechanism present in modern Angular SSR. CVE-2026-111754 targets versions 20+/21+/22+ where @angular/ssr automatically emits HTTP redirects on router state mismatches. v5.2.11's SSR architecture predates this by many years and only provides HT..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2026-46417" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2026-50168" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2026-50555" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2026-50556" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2026-69149" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.21 of @angular/platform-server. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-88056" }, "impact_statement": "not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-88058 does not affect version 5.2.11-tuxcare.21 of @angular/platform-server. not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ...", "vulnerability": { "name": "CVE-2026-88058" }, "impact_statement": "not_affected \u2014 CVE-2026-88058 affects the domino library's HTML serialization (XSS via ancestor fallback raw-content tag injection in comments/processing instructions during SSR). The target Angular 5.2.11-tuxcare.19 repository declares domino 2.1.2 as a dependency but does NOT vendor its source code. The vulnerable code (NodeUtils.js serializeOne() function) lives in the domino npm package, not in Angular's ..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21", "identifiers": { "purl": "pkg:npm/%40angular/platform-server@5.2.11-tuxcare.21" } } ], "timestamp": "2026-10-19T03:17:00.158398+00:00", "status_notes": "Vulnerability CVE-2026-88060 is fixed in version 5.2.11-tuxcare.21 of @angular/platform-server.", "vulnerability": { "name": "CVE-2026-88060" } } ] }