{ "@id": "urn:uuid:14787250-328a-4d11-9886-c4a357605fe6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:45:04.910133+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:40:02.410001+00:00", "status_notes": "Vulnerability CVE-2014-3743 does not affect version 14.0.0 of marked. not_affected \u2014 CVE-2014-3743 affected marked versions \u22640.3.0 where JavaScript URLs could bypass the sanitize:true option. The target version 14.0.0 is not affected because the vulnerable sanitize feature was completely removed by upstream in commit 22ebdb25 (September 2023), which shipped in the upstream release before TuxCare onboarded version 14.0.0. The library now explicitly documents that it does not san...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3743" }, "impact_statement": "not_affected \u2014 CVE-2014-3743 affected marked versions \u22640.3.0 where JavaScript URLs could bypass the sanitize:true option. The target version 14.0.0 is not affected because the vulnerable sanitize feature was completely removed by upstream in commit 22ebdb25 (September 2023), which shipped in the upstream release before TuxCare onboarded version 14.0.0. The library now explicitly documents that it does not san..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:24:00.057946+00:00", "status_notes": "Vulnerability CVE-2015-1370 does not affect version 14.0.0 of marked. not_affected \u2014 The target version 14.0.0 is NOT affected by CVE-2015-1370. The vulnerability affected versions 0.3.2 and earlier where the `sanitize:true` option failed to block `vbscript:` protocol URLs. The vulnerable code (the built-in sanitization feature with the vbscript bypass) was removed in upstream version 8.0.0 by commit 22ebdb25 (author: tony@brix.ninja), which shipped in the upstream release befo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1370" }, "impact_statement": "not_affected \u2014 The target version 14.0.0 is NOT affected by CVE-2015-1370. The vulnerability affected versions 0.3.2 and earlier where the `sanitize:true` option failed to block `vbscript:` protocol URLs. The vulnerable code (the built-in sanitization feature with the vbscript bypass) was removed in upstream version 8.0.0 by commit 22ebdb25 (author: tony@brix.ninja), which shipped in the upstream release befo..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2015-8854 affects version 14.0.0 of marked.", "vulnerability": { "name": "CVE-2015-8854" }, "action_statement": "Vulnerability CVE-2015-8854 affects version 14.0.0 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:33:00.106702+00:00", "status_notes": "Vulnerability CVE-2016-10531 does not affect version 14.0.0 of marked. not_affected \u2014 CVE-2016-10531 affects marked < 0.3.6 due to a vulnerable regex in the unescape function that allowed malformed HTML entities (e.g., `:document;`) to bypass sanitization. The target version 14.0.0-tuxcare.1 contains the upstream fix from v0.3.6 (July 2016): the strict entity-matching regex `/&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig` at src/helpers.ts:31. This fix was authored by Matt Aust...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10531" }, "impact_statement": "not_affected \u2014 CVE-2016-10531 affects marked < 0.3.6 due to a vulnerable regex in the unescape function that allowed malformed HTML entities (e.g., `:document;`) to bypass sanitization. The target version 14.0.0-tuxcare.1 contains the upstream fix from v0.3.6 (July 2016): the strict entity-matching regex `/&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig` at src/helpers.ts:31. This fix was authored by Matt Aust..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2017-1000427 affects version 14.0.0 of marked.", "vulnerability": { "name": "CVE-2017-1000427" }, "action_statement": "Vulnerability CVE-2017-1000427 affects version 14.0.0 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-16114 affects version 14.0.0 of marked.", "vulnerability": { "name": "CVE-2017-16114" }, "action_statement": "Vulnerability CVE-2017-16114 affects version 14.0.0 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 14.0.0.", "vulnerability": { "name": "CVE-2017-17461" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:45:04.910133+00:00", "status_notes": "Vulnerability CVE-2018-25110 does not affect version 14.0.0 of marked. not_affected \u2014 CVE-2018-25110 describes ReDoS vulnerabilities in four regular expressions used by marked for parsing HTML tags and markdown links. The upstream fix (commit b15e42b6 by Jamie Davis, 2018-02-26) modified these patterns to eliminate catastrophic backtracking by excluding whitespace from HTML tag attribute character classes and excluding opening brackets from link content character classes. This f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-25110" }, "impact_statement": "not_affected \u2014 CVE-2018-25110 describes ReDoS vulnerabilities in four regular expressions used by marked for parsing HTML tags and markdown links. The upstream fix (commit b15e42b6 by Jamie Davis, 2018-02-26) modified these patterns to eliminate catastrophic backtracking by excluding whitespace from HTML tag attribute character classes and excluding opening brackets from link content character classes. This f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:40:12.229007+00:00", "status_notes": "Vulnerability CVE-2021-21306 does not affect version 14.0.0 of marked. not_affected \u2014 Target version 14.0.0-tuxcare.1 is NOT vulnerable to CVE-2021-21306 (ReDoS in emphasis/strong parsing). The vulnerable regex patterns with catastrophic backtracking are not present. The target contains the fixed emStrong tokenizer implementation with linear-time regex patterns, which was introduced in upstream marked v2.0.0 (commit 7293251c, Feb 2021) and shipped in the upstream v14.0.0 release...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21306" }, "impact_statement": "not_affected \u2014 Target version 14.0.0-tuxcare.1 is NOT vulnerable to CVE-2021-21306 (ReDoS in emphasis/strong parsing). The vulnerable regex patterns with catastrophic backtracking are not present. The target contains the fixed emStrong tokenizer implementation with linear-time regex patterns, which was introduced in upstream marked v2.0.0 (commit 7293251c, Feb 2021) and shipped in the upstream v14.0.0 release..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:07:00.152092+00:00", "status_notes": "Vulnerability CVE-2022-21680 affects version 14.0.0 of marked.", "vulnerability": { "name": "CVE-2022-21680" }, "action_statement": "Vulnerability CVE-2022-21680 affects version 14.0.0 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2022-21681 affects version 14.0.0 of marked.", "vulnerability": { "name": "CVE-2022-21681" }, "action_statement": "Vulnerability CVE-2022-21681 affects version 14.0.0 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-10-23T17:15:33.162227+00:00", "status_notes": "Vulnerability CVE-2026-41680 affects version 14.0.0 of marked, and is fixed in 14.0.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-41680" }, "action_statement": "Vulnerability CVE-2026-41680 affects version 14.0.0 of marked, and is fixed in 14.0.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 14.0.0.", "vulnerability": { "name": "GHSA-32vw-r77c-gm67" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 14.0.0.", "vulnerability": { "name": "GHSA-7m7q-q53v-j47v" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 14.0.0.", "vulnerability": { "name": "GHSA-8wp3-cp9v-44fm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:38:00.054058+00:00", "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 14.0.0 of marked. not_affected \u2014 The target version (marked 14.0.0) is NOT affected by GHSA-ch52-vgq2-943f. The ReDoS vulnerability in the `_label` subrule was fixed in upstream v0.7.0 (July 2019, commit ded5e24f) and is not present in version 14.0.0. The vulnerable regex pattern `|`(?!`)|` that caused catastrophic backtracking was removed and replaced with a simpler pattern that eliminates the exponential-time parsing paths. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-ch52-vgq2-943f" }, "impact_statement": "not_affected \u2014 The target version (marked 14.0.0) is NOT affected by GHSA-ch52-vgq2-943f. The ReDoS vulnerability in the `_label` subrule was fixed in upstream v0.7.0 (July 2019, commit ded5e24f) and is not present in version 14.0.0. The vulnerable regex pattern `|`(?!`)|` that caused catastrophic backtracking was removed and replaced with a simpler pattern that eliminates the exponential-time parsing paths. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-02T18:07:00.152092+00:00", "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 14.0.0.", "vulnerability": { "name": "GHSA-wjmf-58vc-xqjr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@14.0.0", "identifiers": { "purl": "pkg:npm/marked@14.0.0" } } ], "timestamp": "2026-11-04T08:34:00.156708+00:00", "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 14.0.0 of marked. not_affected \u2014 Target version 14.0.0-tuxcare.1 is NOT affected by GHSA-xf5p-87ch-gxw2 (ReDoS vulnerability in email/text parsing). The CVE affects versions 0.3.14 through 0.6.2, with fixes released in 0.6.2. The target version is 13+ major versions beyond the fix release. All vulnerable regex patterns (catastrophic backtracking in HTML/tag parsing and quadratic email/line-break scanning) have been fixed by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-xf5p-87ch-gxw2" }, "impact_statement": "not_affected \u2014 Target version 14.0.0-tuxcare.1 is NOT affected by GHSA-xf5p-87ch-gxw2 (ReDoS vulnerability in email/text parsing). The CVE affects versions 0.3.14 through 0.6.2, with fixes released in 0.6.2. The target version is 13+ major versions beyond the fix release. All vulnerable regex patterns (catastrophic backtracking in HTML/tag parsing and quadratic email/line-break scanning) have been fixed by up..." } ] }