{
  "@id": "urn:uuid:9e453cd9-652e-4b00-ae89-49b2bcee1fdf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:45:41.566773+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highlight.js@10.4.1",
          "identifiers": {
            "purl": "pkg:npm/highlight.js@10.4.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:45:41.566773+00:00",
      "status_notes": "Vulnerability CVE-2020-26237 does not affect version 10.4.1 of highlight.js. not_affected \u2014 Target version 10.4.1 is NOT affected by CVE-2020-26237. The fix (using Object.create(null) for languages and aliases objects) was introduced in upstream version 10.2.0 and is present in this release. The vulnerable pattern (using {} which inherits from Object.prototype) does not exist in the codebase. This fix was authored by upstream developer Zack (night@users.noreply.github.com), not TuxCar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26237"
      },
      "impact_statement": "not_affected \u2014 Target version 10.4.1 is NOT affected by CVE-2020-26237. The fix (using Object.create(null) for languages and aliases objects) was introduced in upstream version 10.2.0 and is present in this release. The vulnerable pattern (using {} which inherits from Object.prototype) does not exist in the codebase. This fix was authored by upstream developer Zack (night@users.noreply.github.com), not TuxCar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highlight.js@10.4.1",
          "identifiers": {
            "purl": "pkg:npm/highlight.js@10.4.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:45:41.566773+00:00",
      "status_notes": "Vulnerability GHSA-7wwv-vh3v-89cq does not affect version 10.4.1 of highlight.js. not_affected \u2014 The target (highlight.js 10.4.1) is not affected by GHSA-7wwv-vh3v-89cq. All vulnerable regex patterns causing exponential and polynomial backtracking have been fixed in the upstream 10.4.1 release. The fixes were authored by the upstream maintainer Josh Goebel and were already present when TuxCare onboarded this version. Verified fixes in handlebars.js (changed /\".*?\"/ to /\"\"|\"[^\"]+\"/), perl.j...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7wwv-vh3v-89cq"
      },
      "impact_statement": "not_affected \u2014 The target (highlight.js 10.4.1) is not affected by GHSA-7wwv-vh3v-89cq. All vulnerable regex patterns causing exponential and polynomial backtracking have been fixed in the upstream 10.4.1 release. The fixes were authored by the upstream maintainer Josh Goebel and were already present when TuxCare onboarded this version. Verified fixes in handlebars.js (changed /\".*?\"/ to /\"\"|\"[^\"]+\"/), perl.j..."
    }
  ]
}