{ "@id": "urn:uuid:ef14ecd0-741d-4ae9-87cd-a65988a6c8d7", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:45:04.910133+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:35:03.436701+00:00", "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier, allowing XSS through javascript: URLs even when sanitize: true is set. The target version 4.0.6-tuxcare.3 contains the complete upstream fix (commits 613bf6ac and 904c71b7 from 2014-01-10 by Christopher Jeffrey). The cleanUrl() function in src/helpers.js implements entity decoding via unescape(), URI component decoding, protocol normaliza...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3743" }, "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier, allowing XSS through javascript: URLs even when sanitize: true is set. The target version 4.0.6-tuxcare.3 contains the complete upstream fix (commits 613bf6ac and 904c71b7 from 2014-01-10 by Christopher Jeffrey). The cleanUrl() function in src/helpers.js implements entity decoding via unescape(), URI component decoding, protocol normaliza..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:21:30.402489+00:00", "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 The target repository (marked v4.0.6-tuxcare.3) is not affected by CVE-2015-1370. The vulnerability was fixed in upstream version 0.3.3 by commit 3c191144 (author: Adam Baldwin), which added the `vbscript:` protocol to the sanitization blocklist alongside the existing `javascript:` check. This fix was already present in the upstream release when TuxCare onboarded the code, as confirmed by the f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1370" }, "impact_statement": "not_affected \u2014 The target repository (marked v4.0.6-tuxcare.3) is not affected by CVE-2015-1370. The vulnerability was fixed in upstream version 0.3.3 by commit 3c191144 (author: Adam Baldwin), which added the `vbscript:` protocol to the sanitization blocklist alongside the existing `javascript:` check. This fix was already present in the upstream release when TuxCare onboarded the code, as confirmed by the f..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.6-tuxcare.2 of marked.", "vulnerability": { "name": "CVE-2015-8854" }, "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.6-tuxcare.2 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:31:00.099165+00:00", "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 CVE-2016-10531 affects the `unescape` function in marked when `sanitize:true` is configured. The vulnerability allowed XSS via malformed HTML entities in link URLs. The target repository (marked 4.0.6-tuxcare.3) contains the upstream fix that was applied in commits 2cff8597 and 31c77995 (May-July 2016). The fix replaced the permissive regex `/&([#\\w]+);/g` with a strict pattern `/&(#(?:\\d+)|(?:...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10531" }, "impact_statement": "not_affected \u2014 CVE-2016-10531 affects the `unescape` function in marked when `sanitize:true` is configured. The vulnerability allowed XSS via malformed HTML entities in link URLs. The target repository (marked 4.0.6-tuxcare.3) contains the upstream fix that was applied in commits 2cff8597 and 31c77995 (May-July 2016). The fix replaced the permissive regex `/&([#\\w]+);/g` with a strict pattern `/&(#(?:\\d+)|(?:..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:24:00.057946+00:00", "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 CVE-2017-1000427 (XSS via data: URI in markdown links) is NOT present in marked v4.0.6-tuxcare.3. The vulnerability was fixed in upstream commit cd2f6f5b by Matt Austin, which added a check to block data: URIs when the sanitize option is enabled. This fix was included in upstream version 0.3.7 (released January 2017) and was already present in the upstream v4.0.6 release when TuxCare onboarded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-1000427" }, "impact_statement": "not_affected \u2014 CVE-2017-1000427 (XSS via data: URI in markdown links) is NOT present in marked v4.0.6-tuxcare.3. The vulnerability was fixed in upstream commit cd2f6f5b by Matt Austin, which added a check to block data: URIs when the sanitize option is enabled. This fix was included in upstream version 0.3.7 (released January 2017) and was already present in the upstream v4.0.6 release when TuxCare onboarded ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.6-tuxcare.2 of marked.", "vulnerability": { "name": "CVE-2017-16114" }, "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.6-tuxcare.2 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.6-tuxcare.2.", "vulnerability": { "name": "CVE-2017-17461" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:45:04.910133+00:00", "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 Target version 4.0.6-tuxcare.3 is NOT AFFECTED by CVE-2018-25110. The upstream security fix (commit b15e42b6) that addresses all four vulnerable ReDoS regex patterns was already present in the upstream release when TuxCare onboarded this version in 2026. All four regex patterns have been hardened: (1) block.pedantic.html closing tag pattern now excludes \\s from [^'\"/>\\\\s]*, (2) inline._attribut...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-25110" }, "impact_statement": "not_affected \u2014 Target version 4.0.6-tuxcare.3 is NOT AFFECTED by CVE-2018-25110. The upstream security fix (commit b15e42b6) that addresses all four vulnerable ReDoS regex patterns was already present in the upstream release when TuxCare onboarded this version in 2026. All four regex patterns have been hardened: (1) block.pedantic.html closing tag pattern now excludes \\s from [^'\"/>\\\\s]*, (2) inline._attribut..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:38:50.475928+00:00", "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 The target repository (marked 4.0.6-tuxcare.3) is not affected by CVE-2021-21306. The vulnerable ReDoS patterns in emphasis/strong regex parsing were removed by upstream commit 7293251c (\"Total rework of Emphasis/Strong\") which was already present in the upstream release when TuxCare onboarded version 4.0.6. The old nested-quantifier backtracking regexes (strong.middle, em.middle with overlapSk...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21306" }, "impact_statement": "not_affected \u2014 The target repository (marked 4.0.6-tuxcare.3) is not affected by CVE-2021-21306. The vulnerable ReDoS patterns in emphasis/strong regex parsing were removed by upstream commit 7293251c (\"Total rework of Emphasis/Strong\") which was already present in the upstream release when TuxCare onboarded version 4.0.6. The old nested-quantifier backtracking regexes (strong.middle, em.middle with overlapSk..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21680 is fixed in version 4.0.6-tuxcare.2 of marked.", "vulnerability": { "name": "CVE-2022-21680" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.6-tuxcare.2 of marked, and is fixed in 4.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2022-21681" }, "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.6-tuxcare.2 of marked, and is fixed in 4.0.6-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41680 does not affect version 4.0.6-tuxcare.2 of marked. Version 4.0.6 is NOT affected by CVE-2026-41680. This vulnerability was introduced in version 18.0.0 and fixed in 18.0.2. Version 4.0.6 predates the introduction of the vulnerability and successfully handles the malicious input (`\\t\\v\\n`) without entering an infinite loop. Empirical testing confirms the target parses the CVE's attack input correctly as an indented code block, with no memory exhaustion or crash.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41680" }, "impact_statement": "Version 4.0.6 is NOT affected by CVE-2026-41680. This vulnerability was introduced in version 18.0.0 and fixed in 18.0.2. Version 4.0.6 predates the introduction of the vulnerability and successfully handles the malicious input (`\\t\\v\\n`) without entering an infinite loop. Empirical testing confirms the target parses the CVE's attack input correctly as an indented code block, with no memory exhaustion or crash." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.6-tuxcare.2.", "vulnerability": { "name": "GHSA-32vw-r77c-gm67" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.6-tuxcare.2.", "vulnerability": { "name": "GHSA-7m7q-q53v-j47v" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.6-tuxcare.2.", "vulnerability": { "name": "GHSA-8wp3-cp9v-44fm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:38:00.054058+00:00", "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 GHSA-ch52-vgq2-943f describes a ReDoS vulnerability in marked's `_label` regex subrule affecting versions < 0.7.0. The vulnerable pattern `/(?:\\[[^\\[\\]]*\\]|\\\\[\\[\\]]?|`[^`]*`|`(?!`)|[^\\[\\]\\\\`])*?/` contained two catastrophic backtracking triggers: `\\\\[\\[\\]]?` (optional matching causing backtracking) and `` `(?!`) `` (negative lookahead causing exponential backtracking with multiple backticks). T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-ch52-vgq2-943f" }, "impact_statement": "not_affected \u2014 GHSA-ch52-vgq2-943f describes a ReDoS vulnerability in marked's `_label` regex subrule affecting versions < 0.7.0. The vulnerable pattern `/(?:\\[[^\\[\\]]*\\]|\\\\[\\[\\]]?|`[^`]*`|`(?!`)|[^\\[\\]\\\\`])*?/` contained two catastrophic backtracking triggers: `\\\\[\\[\\]]?` (optional matching causing backtracking) and `` `(?!`) `` (negative lookahead causing exponential backtracking with multiple backticks). T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.6-tuxcare.2.", "vulnerability": { "name": "GHSA-wjmf-58vc-xqjr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.6-tuxcare.2", "identifiers": { "purl": "pkg:npm/marked@4.0.6-tuxcare.2" } } ], "timestamp": "2026-11-04T08:33:00.106702+00:00", "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 4.0.6-tuxcare.2 of marked. not_affected \u2014 Target repository marked v4.0.6-tuxcare.3 is NOT AFFECTED by GHSA-xf5p-87ch-gxw2 (ReDoS in email address parsing). The vulnerability affects versions 0.3.14 to 0.6.2, but the fix (commit be27472a by Anders Kaseorg, April 2019) was already included in upstream v4.0.6 (released December 2021) before TuxCare onboarded it. The target code contains the fixed regex patterns in src/rules.js (lines 178...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-xf5p-87ch-gxw2" }, "impact_statement": "not_affected \u2014 Target repository marked v4.0.6-tuxcare.3 is NOT AFFECTED by GHSA-xf5p-87ch-gxw2 (ReDoS in email address parsing). The vulnerability affects versions 0.3.14 to 0.6.2, but the fix (commit be27472a by Anders Kaseorg, April 2019) was already included in upstream v4.0.6 (released December 2021) before TuxCare onboarded it. The target code contains the fixed regex patterns in src/rules.js (lines 178..." } ] }