{
  "@id": "urn:uuid:f33fc905-c157-4e5d-ba5d-2c8a528c77ad",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:46:00.060809+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:36:59.454202+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 2.1.3 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0 due to XSS vulnerabilities from insufficient JavaScript URL sanitization even with sanitize:true enabled. The target (marked 2.1.3) is NOT affected because the upstream vendor already fixed this vulnerability in commit 099983ffc (Nov 2019) by implementing proper HTML entity decoding and JavaScript URL blocking in the cleanUrl() function. This fix was...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0 due to XSS vulnerabilities from insufficient JavaScript URL sanitization even with sanitize:true enabled. The target (marked 2.1.3) is NOT affected because the upstream vendor already fixed this vulnerability in commit 099983ffc (Nov 2019) by implementing proper HTML entity decoding and JavaScript URL blocking in the cleanUrl() function. This fix was..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:23:00.049758+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 2.1.3 of marked. not_affected \u2014 CVE-2015-1370 affects marked \u22640.3.2 where vbscript: protocol URLs were not blocked even with sanitize:true. The target (marked v2.1.3-tuxcare.1) contains the upstream fix (commit 3c191144 by Adam Baldwin) that adds vbscript: to the protocol blacklist in the cleanUrl() function. This fix was already present in the upstream release v2.1.3 before TuxCare onboarded it. The vulnerable pattern (vbscr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-1370 affects marked \u22640.3.2 where vbscript: protocol URLs were not blocked even with sanitize:true. The target (marked v2.1.3-tuxcare.1) contains the upstream fix (commit 3c191144 by Adam Baldwin) that adds vbscript: to the protocol blacklist in the cleanUrl() function. This fix was already present in the upstream release v2.1.3 before TuxCare onboarded it. The vulnerable pattern (vbscr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 2.1.3 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 2.1.3 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:30:24.356556+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 2.1.3 of marked. not_affected \u2014 The target repository (marked v2.1.3-tuxcare.1) is NOT affected by CVE-2016-10531. The vulnerability was fixed in upstream commit 2cff8597 (May 2015) which was already included in the upstream release 2.1.3 that TuxCare onboarded. The fix modifies the unescape() function's regex pattern to strictly match only well-formed HTML entities, preventing XSS attacks through entity obfuscation in link U...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 The target repository (marked v2.1.3-tuxcare.1) is NOT affected by CVE-2016-10531. The vulnerability was fixed in upstream commit 2cff8597 (May 2015) which was already included in the upstream release 2.1.3 that TuxCare onboarded. The fix modifies the unescape() function's regex pattern to strictly match only well-formed HTML entities, preventing XSS attacks through entity obfuscation in link U..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:27:00.040224+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 2.1.3 of marked. not_affected \u2014 CVE-2017-1000427 is NOT present in marked version 2.1.3-tuxcare.1. The vulnerability affected marked 0.3.6 and earlier where data: URIs in markdown links could execute arbitrary JavaScript when the sanitize option was enabled. The fix was already included in the upstream version 2.1.3 release that TuxCare onboarded, authored by Matt Austin (matt@m-austin.com) in commit cd2f6f5b on 2017-01-19. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-1000427 is NOT present in marked version 2.1.3-tuxcare.1. The vulnerability affected marked 0.3.6 and earlier where data: URIs in markdown links could execute arbitrary JavaScript when the sanitize option was enabled. The fix was already included in the upstream version 2.1.3 release that TuxCare onboarded, authored by Matt Austin (matt@m-austin.com) in commit cd2f6f5b on 2017-01-19. T..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 2.1.3 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 2.1.3 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 2.1.3.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:46:00.060809+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 2.1.3 of marked. not_affected \u2014 CVE-2018-25110 is not present in marked version 2.1.3-tuxcare.1. The vulnerability was fixed in upstream commit b15e42b6 (Feb 2018) by Jamie Davis, which modified four regular expressions to eliminate catastrophic backtracking. This fix was already present in the upstream release that TuxCare used as the base for version 2.1.3, as confirmed by the fix commit being an ancestor of the first TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-25110 is not present in marked version 2.1.3-tuxcare.1. The vulnerability was fixed in upstream commit b15e42b6 (Feb 2018) by Jamie Davis, which modified four regular expressions to eliminate catastrophic backtracking. This fix was already present in the upstream release that TuxCare used as the base for version 2.1.3, as confirmed by the fix commit being an ancestor of the first TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:42:56.614394+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 2.1.3 of marked. not_affected \u2014 The target (marked v2.1.3-tuxcare.1) is NOT AFFECTED by CVE-2021-21306 (ReDoS via nested-quantifier regex in emphasis/strong parsing). The vulnerable regex patterns containing nested quantifiers and `overlapSkip` have been completely removed and replaced with a linear delimiter-counting algorithm. The fix (commit 7293251c) was authored by upstream developer Trevor Buckner and shipped in the ups...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 The target (marked v2.1.3-tuxcare.1) is NOT AFFECTED by CVE-2021-21306 (ReDoS via nested-quantifier regex in emphasis/strong parsing). The vulnerable regex patterns containing nested quantifiers and `overlapSkip` have been completely removed and replaced with a linear delimiter-counting algorithm. The fix (commit 7293251c) was authored by upstream developer Trevor Buckner and shipped in the ups..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-09-30T22:30:26.007150+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 2.1.3 of marked, and is fixed in 2.1.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 2.1.3 of marked, and is fixed in 2.1.3-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-09-30T22:30:26.007150+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 2.1.3 of marked, and is fixed in 2.1.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 2.1.3 of marked, and is fixed in 2.1.3-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-10-06T12:53:00.152535+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 2.1.3 of marked. Version 2.1.3 is NOT AFFECTED by CVE-2026-41680. The infinite loop vulnerability was introduced in version 18.0.0 (2026) during a major TypeScript architectural rewrite and fixed in 18.0.2. The target version 2.1.3 (2021) uses a different JavaScript-based tokenization architecture that successfully consumes the CVE's proof-of-concept input (`\\t\\v\\n`) in a single iteration, preventing the infinite loop condition. The CVE's specific version range \"18.0.0 to 18.0.1\" and the massive codebase changes (30+ file modifications, JavaScript\u2192TypeScript migration) between 2.1.3 and 18.0.0 confirm the vulnerability pattern does not exist in this older architecture.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Version 2.1.3 is NOT AFFECTED by CVE-2026-41680. The infinite loop vulnerability was introduced in version 18.0.0 (2026) during a major TypeScript architectural rewrite and fixed in 18.0.2. The target version 2.1.3 (2021) uses a different JavaScript-based tokenization architecture that successfully consumes the CVE's proof-of-concept input (`\\t\\v\\n`) in a single iteration, preventing the infinite loop condition. The CVE's specific version range \"18.0.0 to 18.0.1\" and the massive codebase changes (30+ file modifications, JavaScript\u2192TypeScript migration) between 2.1.3 and 18.0.0 confirm the vulnerability pattern does not exist in this older architecture."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 2.1.3.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 2.1.3.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:07:00.152092+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 2.1.3.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-04T08:41:00.043766+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 2.1.3 of marked. not_affected \u2014 GHSA-ch52-vgq2-943f describes a ReDoS vulnerability in the inline._label regex that was fixed in marked v0.7.0 (July 2019). The target version 2.1.3 (June 2021) already includes this upstream fix. The vulnerable pattern \\\\[\\[\\]]? was replaced with \\\\. to prevent catastrophic backtracking on malformed input. This fix shipped with the upstream v2.1.3 release, not as a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "impact_statement": "not_affected \u2014 GHSA-ch52-vgq2-943f describes a ReDoS vulnerability in the inline._label regex that was fixed in marked v0.7.0 (July 2019). The target version 2.1.3 (June 2021) already includes this upstream fix. The vulnerable pattern \\\\[\\[\\]]? was replaced with \\\\. to prevent catastrophic backtracking on malformed input. This fix shipped with the upstream v2.1.3 release, not as a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:07:00.152092+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 2.1.3.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.1.3",
          "identifiers": {
            "purl": "pkg:npm/marked@2.1.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 2.1.3 of marked.",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "action_statement": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 2.1.3 of marked."
    }
  ]
}