{ "@id": "urn:uuid:e6ce3fcc-be5b-4a2b-9d06-1b5d8fc1b421", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:46:00.060809+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-04T08:35:03.436701+00:00", "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.10 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0 (XSS via javascript: URLs with HTML entity encoding). The target version 4.0.10 contains the complete upstream fix from v0.3.1 (January 2014). The fix was authored by Christopher Jeffrey (upstream maintainer) and was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (missing HTML entity decoding before javascript:...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3743" }, "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0 (XSS via javascript: URLs with HTML entity encoding). The target version 4.0.10 contains the complete upstream fix from v0.3.1 (January 2014). The fix was authored by Christopher Jeffrey (upstream maintainer) and was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (missing HTML entity decoding before javascript:..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-04T08:23:00.049758+00:00", "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.10 of marked. not_affected \u2014 CVE-2015-1370 affects marked versions \u22640.3.2 with XSS via vbscript: protocol bypass when sanitize:true. Target version 4.0.10 is NOT vulnerable. The vbscript: protocol filtering was added by upstream commit 3c191144 (Adam Baldwin, 2015-01-22) and released in version 0.3.3. This fix was already present in the upstream codebase when TuxCare onboarded version 4.0.10. The defense is implemented in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1370" }, "impact_statement": "not_affected \u2014 CVE-2015-1370 affects marked versions \u22640.3.2 with XSS via vbscript: protocol bypass when sanitize:true. Target version 4.0.10 is NOT vulnerable. The vbscript: protocol filtering was added by upstream commit 3c191144 (Adam Baldwin, 2015-01-22) and released in version 0.3.3. This fix was already present in the upstream codebase when TuxCare onboarded version 4.0.10. The defense is implemented in ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.10 of marked.", "vulnerability": { "name": "CVE-2015-8854" }, "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.10 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-04T08:33:00.106702+00:00", "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.10 of marked. not_affected \u2014 CVE-2016-10531 XSS vulnerability in marked's link URI entity handling is NOT present in target version 4.0.10. The fix was applied in upstream commit 31c77995 (July 2016) by Rafa\u0142 Pocztarski, which shipped in the upstream release before TuxCare onboarding. The target contains the fixed regex /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig that prevents malformed HTML entity parsing in link URIs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10531" }, "impact_statement": "not_affected \u2014 CVE-2016-10531 XSS vulnerability in marked's link URI entity handling is NOT present in target version 4.0.10. The fix was applied in upstream commit 31c77995 (July 2016) by Rafa\u0142 Pocztarski, which shipped in the upstream release before TuxCare onboarding. The target contains the fixed regex /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig that prevents malformed HTML entity parsing in link URIs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-04T08:27:00.040224+00:00", "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.10 of marked. not_affected \u2014 CVE-2017-1000427 describes an XSS vulnerability in marked's data: URI parser (versions \u22640.3.6). The target (marked v4.0.10) contains the upstream fix that blocks data: URIs in the sanitize code path. The fix was added by Matt Austin in commit cd2f6f5b (Jan 2017), shipped in upstream v0.3.7 onwards, and is present in v4.0.10. No TuxCare/CloudLinux commits exist in HEAD's ancestry (0 out of 2645 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-1000427" }, "impact_statement": "not_affected \u2014 CVE-2017-1000427 describes an XSS vulnerability in marked's data: URI parser (versions \u22640.3.6). The target (marked v4.0.10) contains the upstream fix that blocks data: URIs in the sanitize code path. The fix was added by Matt Austin in commit cd2f6f5b (Jan 2017), shipped in upstream v0.3.7 onwards, and is present in v4.0.10. No TuxCare/CloudLinux commits exist in HEAD's ancestry (0 out of 2645 ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.10 of marked.", "vulnerability": { "name": "CVE-2017-16114" }, "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.10 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.10.", "vulnerability": { "name": "CVE-2017-17461" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-04T08:46:00.060809+00:00", "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.10 of marked. not_affected \u2014 CVE-2018-25110 affects Marked versions prior to 0.3.17. The target version 4.0.10 does not contain the vulnerable regex patterns that cause catastrophic backtracking. All four vulnerable patterns identified in the 2018 security patch have been replaced with their fixed versions. The fix was applied in upstream commit b15e42b6 (Feb 2018) by Jamie Davis and shipped in upstream v0.3.18, which pred...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-25110" }, "impact_statement": "not_affected \u2014 CVE-2018-25110 affects Marked versions prior to 0.3.17. The target version 4.0.10 does not contain the vulnerable regex patterns that cause catastrophic backtracking. All four vulnerable patterns identified in the 2018 security patch have been replaced with their fixed versions. The fix was applied in upstream commit b15e42b6 (Feb 2018) by Jamie Davis and shipped in upstream v0.3.18, which pred..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-04T08:40:02.410001+00:00", "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.10 of marked. not_affected \u2014 CVE-2021-21306 (ReDoS in emphasis/strong parsing) is NOT present in marked 4.0.10. The vulnerable nested-quantifier regex patterns (strong.middle, em.middle) that cause catastrophic backtracking have been replaced with a safe delimiter-counting algorithm in the unified emStrong() method. This fix was authored by upstream maintainer Trevor Buckner and shipped in marked v2.0.0 (2021-02-07), well ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21306" }, "impact_statement": "not_affected \u2014 CVE-2021-21306 (ReDoS in emphasis/strong parsing) is NOT present in marked 4.0.10. The vulnerable nested-quantifier regex patterns (strong.middle, em.middle) that cause catastrophic backtracking have been replaced with a safe delimiter-counting algorithm in the unified emStrong() method. This fix was authored by upstream maintainer Trevor Buckner and shipped in marked v2.0.0 (2021-02-07), well ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:07:00.152092+00:00", "status_notes": "Vulnerability CVE-2022-21680 affects version 4.0.10 of marked.", "vulnerability": { "name": "CVE-2022-21680" }, "action_statement": "Vulnerability CVE-2022-21680 affects version 4.0.10 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:07:00.152092+00:00", "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.10 of marked.", "vulnerability": { "name": "CVE-2022-21681" }, "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.10 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41680 affects version 4.0.10 of marked.", "vulnerability": { "name": "CVE-2026-41680" }, "action_statement": "Vulnerability CVE-2026-41680 affects version 4.0.10 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.10.", "vulnerability": { "name": "GHSA-32vw-r77c-gm67" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.10.", "vulnerability": { "name": "GHSA-7m7q-q53v-j47v" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:07:00.152092+00:00", "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.10.", "vulnerability": { "name": "GHSA-8wp3-cp9v-44fm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-ch52-vgq2-943f affects version 4.0.10 of marked.", "vulnerability": { "name": "GHSA-ch52-vgq2-943f" }, "action_statement": "Vulnerability GHSA-ch52-vgq2-943f affects version 4.0.10 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:07:00.152092+00:00", "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.10.", "vulnerability": { "name": "GHSA-wjmf-58vc-xqjr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.10", "identifiers": { "purl": "pkg:npm/marked@4.0.10" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 4.0.10 of marked.", "vulnerability": { "name": "GHSA-xf5p-87ch-gxw2" }, "action_statement": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 4.0.10 of marked." } ] }