{
  "@id": "urn:uuid:e0cf8387-5e16-4de3-a62a-f044c581ffa0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:46:00.060809+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:35:03.436701+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 1.2.7 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier. The target version 1.2.7 contains the complete upstream fix released in v0.3.1 (2014). Both patches are present: (1) the unescape function that decodes HTML entities to prevent bypassing sanitization with encoded colons like : or :, and (2) the cleanUrl sanitization that blocks javascript:, vbscript:, and data: protocols. The fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier. The target version 1.2.7 contains the complete upstream fix released in v0.3.1 (2014). Both patches are present: (1) the unescape function that decodes HTML entities to prevent bypassing sanitization with encoded colons like : or :, and (2) the cleanUrl sanitization that blocks javascript:, vbscript:, and data: protocols. The fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:21:30.402489+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 1.2.7 of marked. not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier due to XSS vulnerability when sanitize:true is set - specifically, vbscript: protocol links were not blocked. The target repository (marked 1.2.7-tuxcare.2) is NOT AFFECTED because the upstream vendor's fix (commit 3c191144 by Adam Baldwin, 2015) was already present in the upstream release 1.2.7 that TuxCare onboarded. The fix adds a check...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier due to XSS vulnerability when sanitize:true is set - specifically, vbscript: protocol links were not blocked. The target repository (marked 1.2.7-tuxcare.2) is NOT AFFECTED because the upstream vendor's fix (commit 3c191144 by Adam Baldwin, 2015) was already present in the upstream release 1.2.7 that TuxCare onboarded. The fix adds a check..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 1.2.7 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 1.2.7 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:30:24.356556+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 1.2.7 of marked. not_affected \u2014 CVE-2016-10531 XSS vulnerability is NOT present in target version 1.2.7-tuxcare.2. The vulnerable HTML entity parsing regex pattern was fixed by upstream vendor in version 0.3.6 (commits 2cff8597 and 31c77995), long before TuxCare onboarding. Current code at src/helpers.js:30 contains the secure regex /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig that properly validates entity formats, preventin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-10531 XSS vulnerability is NOT present in target version 1.2.7-tuxcare.2. The vulnerable HTML entity parsing regex pattern was fixed by upstream vendor in version 0.3.6 (commits 2cff8597 and 31c77995), long before TuxCare onboarding. Current code at src/helpers.js:30 contains the secure regex /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig that properly validates entity formats, preventin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:24:43.977524+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 1.2.7 of marked. not_affected \u2014 CVE-2017-1000427 affects marked 0.3.6 and earlier due to missing sanitization of data: URIs in links, enabling XSS attacks. The target repository (marked 1.2.7-tuxcare.2) is NOT affected because the fix was already present in upstream release 0.3.7 (January 2017) before TuxCare onboarded version 1.2.7 (August 2026). The fix adds a protocol check in cleanUrl function (lib/marked.js:199) to rejec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-1000427 affects marked 0.3.6 and earlier due to missing sanitization of data: URIs in links, enabling XSS attacks. The target repository (marked 1.2.7-tuxcare.2) is NOT affected because the fix was already present in upstream release 0.3.7 (January 2017) before TuxCare onboarded version 1.2.7 (August 2026). The fix adds a protocol check in cleanUrl function (lib/marked.js:199) to rejec..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 1.2.7 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 1.2.7 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 1.2.7.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:46:00.060809+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 1.2.7 of marked. not_affected \u2014 The target (marked version 1.2.7-tuxcare.2) is not affected by CVE-2018-25110. The ReDoS vulnerability in four regular expressions was fixed in marked version 0.3.17 (February 2018) by upstream author Jamie Davis (davisjam@vt.edu). The fix was already present in the upstream marked 1.2.7 release that TuxCare onboarded. Testing with the original ReDoS payloads from the security patch confirms th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 The target (marked version 1.2.7-tuxcare.2) is not affected by CVE-2018-25110. The ReDoS vulnerability in four regular expressions was fixed in marked version 0.3.17 (February 2018) by upstream author Jamie Davis (davisjam@vt.edu). The fix was already present in the upstream marked 1.2.7 release that TuxCare onboarded. Testing with the original ReDoS payloads from the security patch confirms th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 affects version 1.2.7 of marked, and is fixed in 1.2.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "action_statement": "Vulnerability CVE-2021-21306 affects version 1.2.7 of marked, and is fixed in 1.2.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 1.2.7 of marked, and is fixed in 1.2.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 1.2.7 of marked, and is fixed in 1.2.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 1.2.7 of marked, and is fixed in 1.2.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 1.2.7 of marked, and is fixed in 1.2.7-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 1.2.7 of marked. Target version 1.2.7 is not affected by CVE-2026-41680. The vulnerability exists in TypeScript-refactored versions (18.0.0-18.0.1) due to a `trimTrailingBlankLines` helper function that uses `.trim()` to detect blank lines, incorrectly treating vertical-tab-only lines as blank and returning empty raw tokens. This function does not exist in version 1.2.7's JavaScript codebase. The target's code tokenizer always returns the full regex match as `raw`, ensuring the lexing loop makes progress and cannot enter the infinite recursion that causes memory exhaustion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Target version 1.2.7 is not affected by CVE-2026-41680. The vulnerability exists in TypeScript-refactored versions (18.0.0-18.0.1) due to a `trimTrailingBlankLines` helper function that uses `.trim()` to detect blank lines, incorrectly treating vertical-tab-only lines as blank and returning empty raw tokens. This function does not exist in version 1.2.7's JavaScript codebase. The target's code tokenizer always returns the full regex match as `raw`, ensuring the lexing loop makes progress and cannot enter the infinite recursion that causes memory exhaustion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 1.2.7.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 1.2.7.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 1.2.7.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f affects version 1.2.7 of marked.",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "action_statement": "Vulnerability GHSA-ch52-vgq2-943f affects version 1.2.7 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 1.2.7.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@1.2.7",
          "identifiers": {
            "purl": "pkg:npm/marked@1.2.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:34:00.156708+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 1.2.7 of marked. not_affected \u2014 Target version 1.2.7 is NOT vulnerable to GHSA-xf5p-87ch-gxw2 (ReDoS in email address evaluation). The vulnerability affected versions 0.3.14 through 0.6.1, and was fixed in upstream version 0.6.2 by commit be27472a (Anders Kaseorg, April 2019). The fix restructured the inline.text regex to prevent quadratic scanning when evaluating email addresses and line breaks. Target version 1.2.7, release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "impact_statement": "not_affected \u2014 Target version 1.2.7 is NOT vulnerable to GHSA-xf5p-87ch-gxw2 (ReDoS in email address evaluation). The vulnerability affected versions 0.3.14 through 0.6.1, and was fixed in upstream version 0.6.2 by commit be27472a (Anders Kaseorg, April 2019). The fix restructured the inline.text regex to prevent quadratic scanning when evaluating email addresses and line breaks. Target version 1.2.7, release..."
    }
  ]
}