{
  "@id": "urn:uuid:15ad427e-026b-469f-a0e1-bde4b2ba8f05",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:44:00.034778+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:34:00.156708+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.7 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier with two XSS vulnerabilities: (1) JavaScript/VBScript/Data URL injection in autolinks and (2) unescaped language identifiers in GFM code blocks. The target repository (marked 4.0.7) is NOT AFFECTED because the upstream fixes were already present when TuxCare onboarded this version. The fixes (commits 904c71b7, 32714af0, 613bf6ac) were auth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier with two XSS vulnerabilities: (1) JavaScript/VBScript/Data URL injection in autolinks and (2) unescaped language identifiers in GFM code blocks. The target repository (marked 4.0.7) is NOT AFFECTED because the upstream fixes were already present when TuxCare onboarded this version. The fixes (commits 904c71b7, 32714af0, 613bf6ac) were auth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:21:00.079636+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.7 of marked. not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier. The target version 4.0.7 contains the upstream fix (commit 3c191144) that blocks vbscript: protocol links. The fix was authored by Adam Baldwin (baldwin@andyet.net) on 2015-01-22 and was already present in the upstream release when TuxCare onboarded this version. The vulnerable code pattern (accepting vbscript: links when sanitize:true) i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier. The target version 4.0.7 contains the upstream fix (commit 3c191144) that blocks vbscript: protocol links. The fix was authored by Adam Baldwin (baldwin@andyet.net) on 2015-01-22 and was already present in the upstream release when TuxCare onboarded this version. The vulnerable code pattern (accepting vbscript: links when sanitize:true) i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.7 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.7 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:29:00.146754+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.7 of marked. not_affected \u2014 CVE-2016-10531 (XSS via malformed HTML entities in links) is not present in marked 4.0.7-tuxcare.2. The fix was already included in the upstream 4.0.7 release that TuxCare onboarded. The vulnerable regex pattern `/&([#\\w]+);/g` has been replaced with the secure pattern `/&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig` which explicitly validates HTML entity formats. Fix commit 2cff85979be8e7a026a9a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-10531 (XSS via malformed HTML entities in links) is not present in marked 4.0.7-tuxcare.2. The fix was already included in the upstream 4.0.7 release that TuxCare onboarded. The vulnerable regex pattern `/&([#\\w]+);/g` has been replaced with the secure pattern `/&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig` which explicitly validates HTML entity formats. Fix commit 2cff85979be8e7a026a9a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:24:00.057946+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.7 of marked. not_affected \u2014 The target marked v4.0.7-tuxcare.2 is not affected by CVE-2017-1000427. The vulnerability in data: URI handling was fixed in upstream marked v0.3.9 (commit cd2f6f5b, Jan 2017) by Matt Austin, long before TuxCare onboarded this version. The fix rejects data: URIs alongside javascript: and vbscript: protocols in the cleanUrl function (src/helpers.js:76), preventing XSS attacks via data URIs in ma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 The target marked v4.0.7-tuxcare.2 is not affected by CVE-2017-1000427. The vulnerability in data: URI handling was fixed in upstream marked v0.3.9 (commit cd2f6f5b, Jan 2017) by Matt Austin, long before TuxCare onboarded this version. The fix rejects data: URIs alongside javascript: and vbscript: protocols in the cleanUrl function (src/helpers.js:76), preventing XSS attacks via data URIs in ma..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.7 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.7 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.7.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:44:00.034778+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.7 of marked. not_affected \u2014 The target (marked 4.0.7-tuxcare.2) is not affected by CVE-2018-25110. The ReDoS vulnerability was fixed in upstream version 0.3.18 via commit b15e42b67cec9ded8505e9d68bb8741ad7a9590d by Jamie Davis, well before TuxCare onboarded the project. All four vulnerable regex patterns (two HTML tag patterns and two bracket/link patterns) have been replaced with safe versions that prevent catastrophic b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 The target (marked 4.0.7-tuxcare.2) is not affected by CVE-2018-25110. The ReDoS vulnerability was fixed in upstream version 0.3.18 via commit b15e42b67cec9ded8505e9d68bb8741ad7a9590d by Jamie Davis, well before TuxCare onboarded the project. All four vulnerable regex patterns (two HTML tag patterns and two bracket/link patterns) have been replaced with safe versions that prevent catastrophic b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-04T08:38:50.475928+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.7 of marked. not_affected \u2014 The target repository (marked v4.0.7-tuxcare.2) is not affected by CVE-2021-21306. The vulnerable regex patterns with nested quantifiers and negative lookahead ((?!overlapSkip)) in the emphasis/strong parsing logic have been replaced with safe delimiter-based patterns in the upstream fix (commit 7293251c). This fix was authored by upstream contributor Trevor Buckner (calculuschild@gmail.com) an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 The target repository (marked v4.0.7-tuxcare.2) is not affected by CVE-2021-21306. The vulnerable regex patterns with nested quantifiers and negative lookahead ((?!overlapSkip)) in the emphasis/strong parsing logic have been replaced with safe delimiter-based patterns in the upstream fix (commit 7293251c). This fix was authored by upstream contributor Trevor Buckner (calculuschild@gmail.com) an..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-10-15T12:56:25.843555+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 4.0.7 of marked, and is fixed in 4.0.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 4.0.7 of marked, and is fixed in 4.0.7-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-10-15T12:56:25.843555+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.7 of marked, and is fixed in 4.0.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.7 of marked, and is fixed in 4.0.7-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 4.0.7 of marked. Version 4.0.7 is NOT AFFECTED by CVE-2026-41680. The vulnerability was introduced in version 18.0.0 (April 2026) by commit b70895f4, which added the `trimTrailingBlankLines` function with buggy blank-line detection. Version 4.0.7 (released before 18.0.0) predates this vulnerability-introducing change and does not contain the vulnerable code path. The specific input sequence `\\t\\v\\n` that triggers infinite loop in 18.0.0-18.0.1 does not cause an infinite loop in 4.0.7 because the `trimTrailingBlankLines` function does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Version 4.0.7 is NOT AFFECTED by CVE-2026-41680. The vulnerability was introduced in version 18.0.0 (April 2026) by commit b70895f4, which added the `trimTrailingBlankLines` function with buggy blank-line detection. Version 4.0.7 (released before 18.0.0) predates this vulnerability-introducing change and does not contain the vulnerable code path. The specific input sequence `\\t\\v\\n` that triggers infinite loop in 18.0.0-18.0.1 does not cause an infinite loop in 4.0.7 because the `trimTrailingBlankLines` function does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.7.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.7.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.7.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f affects version 4.0.7 of marked.",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "action_statement": "Vulnerability GHSA-ch52-vgq2-943f affects version 4.0.7 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.7.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.7",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.7"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 4.0.7 of marked.",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "action_statement": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 4.0.7 of marked."
    }
  ]
}