{
  "@id": "urn:uuid:133c4d9a-832e-4b9b-b564-9766d570f577",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:46:44.099106+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:36:59.454202+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 13.0.3 of marked. not_affected \u2014 CVE-2014-3743 affected marked versions \u22640.3.0 where the sanitize option could be bypassed using HTML entity-encoded javascript: URLs. The target version 13.0.3 is not affected because: (1) The original vulnerability was fixed in January 2014 by upstream commits 904c71b7 and 613bf6ac, which added proper HTML entity decoding and javascript: protocol blocking to the sanitize feature. (2) The entir...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affected marked versions \u22640.3.0 where the sanitize option could be bypassed using HTML entity-encoded javascript: URLs. The target version 13.0.3 is not affected because: (1) The original vulnerability was fixed in January 2014 by upstream commits 904c71b7 and 613bf6ac, which added proper HTML entity decoding and javascript: protocol blocking to the sanitize feature. (2) The entir..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:27:00.040224+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 13.0.3 of marked. not_affected \u2014 CVE-2015-1370 affects the sanitize feature in marked versions \u22640.3.2, where vbscript: protocol bypassed sanitization even with sanitize:true. Target version 13.0.3 is not affected because the entire sanitize feature was removed by upstream in v8.0.0+ (commit 22ebdb25, Sept 2023). The vulnerable code path (sanitize feature with incomplete protocol filtering) does not exist in the current codebas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-1370 affects the sanitize feature in marked versions \u22640.3.2, where vbscript: protocol bypassed sanitization even with sanitize:true. Target version 13.0.3 is not affected because the entire sanitize feature was removed by upstream in v8.0.0+ (commit 22ebdb25, Sept 2023). The vulnerable code path (sanitize feature with incomplete protocol filtering) does not exist in the current codebas..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 13.0.3 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 13.0.3 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:31:00.099165+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 13.0.3 of marked. not_affected \u2014 The target repository (marked v13.0.3) is not affected by CVE-2016-10531. The vulnerability was fixed in upstream version 0.3.6 (July 2016) by commits 2cff85979be8 and 31c77995d59c. The fix modified the unescape() function's regex from the overly permissive /&([#\\w]+);/g to the restrictive /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig pattern that only matches valid HTML entities. The current co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 The target repository (marked v13.0.3) is not affected by CVE-2016-10531. The vulnerability was fixed in upstream version 0.3.6 (July 2016) by commits 2cff85979be8 and 31c77995d59c. The fix modified the unescape() function's regex from the overly permissive /&([#\\w]+);/g to the restrictive /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig pattern that only matches valid HTML entities. The current co..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 affects version 13.0.3 of marked.",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "action_statement": "Vulnerability CVE-2017-1000427 affects version 13.0.3 of marked."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 13.0.3 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 13.0.3 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 13.0.3.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:46:44.099106+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 13.0.3 of marked. not_affected \u2014 The target repository (marked v13.0.3) is not affected by CVE-2018-25110. The vulnerability was fixed by upstream author Jamie Davis in commit b15e42b6 (February 2018), which was included in upstream release v0.3.18. The fix was already present in the upstream release before TuxCare onboarded this version. All four vulnerable regex patterns have been replaced with safe versions that prevent cat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 The target repository (marked v13.0.3) is not affected by CVE-2018-25110. The vulnerability was fixed by upstream author Jamie Davis in commit b15e42b6 (February 2018), which was included in upstream release v0.3.18. The fix was already present in the upstream release before TuxCare onboarded this version. All four vulnerable regex patterns have been replaced with safe versions that prevent cat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:42:56.614394+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 13.0.3 of marked. not_affected \u2014 CVE-2021-21306 (ReDoS in emphasis/strong regex patterns) is not present in marked v13.0.3. The vulnerable regex patterns (strong.start, strong.middle, em.start, em.middle with nested overlapSkip quantifiers causing catastrophic backtracking) were replaced with simpler emStrong patterns by upstream commit 7293251c in version 2.0.0. The fix was authored by Trevor Buckner (calculuschild@gmail.com)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21306 (ReDoS in emphasis/strong regex patterns) is not present in marked v13.0.3. The vulnerable regex patterns (strong.start, strong.middle, em.start, em.middle with nested overlapSkip quantifiers causing catastrophic backtracking) were replaced with simpler emStrong patterns by upstream commit 7293251c in version 2.0.0. The fix was authored by Trevor Buckner (calculuschild@gmail.com)..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 13.0.3 of marked.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 13.0.3 of marked."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 13.0.3 of marked.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 13.0.3 of marked."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-09-27T12:11:00.236690+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 affects version 13.0.3 of marked.",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "action_statement": "Vulnerability CVE-2026-41680 affects version 13.0.3 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 13.0.3.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 13.0.3.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 13.0.3.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:40:02.410001+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 13.0.3 of marked. not_affected \u2014 Target version 13.0.3 is not affected by GHSA-ch52-vgq2-943f. The vulnerable ReDoS pattern in the `_label` regex (specifically `\\\\[\\[\\]]?`) was fixed in upstream v0.7.0 (July 2019) via PR #1515. The fix changed the problematic pattern to `\\\\.`, eliminating catastrophic backtracking. Version 13.0.3 includes this fix, as confirmed by examining src/rules.ts line 229 which contains the fixed patter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "impact_statement": "not_affected \u2014 Target version 13.0.3 is not affected by GHSA-ch52-vgq2-943f. The vulnerable ReDoS pattern in the `_label` regex (specifically `\\\\[\\[\\]]?`) was fixed in upstream v0.7.0 (July 2019) via PR #1515. The fix changed the problematic pattern to `\\\\.`, eliminating catastrophic backtracking. Version 13.0.3 includes this fix, as confirmed by examining src/rules.ts line 229 which contains the fixed patter..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 13.0.3.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@13.0.3",
          "identifiers": {
            "purl": "pkg:npm/marked@13.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:34:00.156708+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 13.0.3 of marked. not_affected \u2014 Target repository marked v13.0.3 is not affected by GHSA-xf5p-87ch-gxw2 (quadratic email regex ReDoS). The vulnerability was fixed in upstream commit be27472a8169dda7875330939f8115ab677cdc07 by Anders Kaseorg on 2019-04-03, which is an ancestor of HEAD. The fix refactored inline.gfm.text regex to use negative character class with lookahead, preventing quadratic-time scanning when processing pot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "impact_statement": "not_affected \u2014 Target repository marked v13.0.3 is not affected by GHSA-xf5p-87ch-gxw2 (quadratic email regex ReDoS). The vulnerability was fixed in upstream commit be27472a8169dda7875330939f8115ab677cdc07 by Anders Kaseorg on 2019-04-03, which is an ancestor of HEAD. The fix refactored inline.gfm.text regex to use negative character class with lookahead, preventing quadratic-time scanning when processing pot..."
    }
  ]
}