{
  "@id": "urn:uuid:7a0afe7b-e39f-48f7-a037-b7a2fa69705f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:46:00.060809+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:34:00.156708+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.9 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier with XSS via JavaScript URLs that bypass sanitization using entity-encoded colons (e.g., javascript:alert(1)). The target (marked 4.0.9) is NOT affected because the upstream fix from 2014 is present. The cleanUrl function (src/helpers.js:67-90) implements the required defense: unescapes HTML entities via unescape(), decodes with deco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier with XSS via JavaScript URLs that bypass sanitization using entity-encoded colons (e.g., javascript:alert(1)). The target (marked 4.0.9) is NOT affected because the upstream fix from 2014 is present. The cleanUrl function (src/helpers.js:67-90) implements the required defense: unescapes HTML entities via unescape(), decodes with deco..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:20:02.866717+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.9 of marked. not_affected \u2014 CVE-2015-1370 describes an XSS vulnerability where vbscript: protocol links bypass sanitization in marked versions \u22640.3.2. The target repository (marked 4.0.9-tuxcare.3 at SHA 92c328f8) is not affected because the upstream fix was already present in the upstream release that TuxCare onboarded. The fix (commit 3c19114 by Adam Baldwin, tagged v0.3.3) adds protocol filtering that rejects vbscript:...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-1370 describes an XSS vulnerability where vbscript: protocol links bypass sanitization in marked versions \u22640.3.2. The target repository (marked 4.0.9-tuxcare.3 at SHA 92c328f8) is not affected because the upstream fix was already present in the upstream release that TuxCare onboarded. The fix (commit 3c19114 by Adam Baldwin, tagged v0.3.3) adds protocol filtering that rejects vbscript:..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.9 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.9 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:31:00.099165+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.9 of marked. not_affected \u2014 CVE-2016-10531 affects marked versions prior to 0.3.6 where the unescape() function used an overly permissive regex pattern /&([#\\w]+);/g that allowed malformed HTML entities like &#58document; to be processed abnormally, enabling XSS attacks when sanitize:true was configured. The target (marked 4.0.9-tuxcare.3) contains the upstream fix: a strict regex /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-10531 affects marked versions prior to 0.3.6 where the unescape() function used an overly permissive regex pattern /&([#\\w]+);/g that allowed malformed HTML entities like &#58document; to be processed abnormally, enabling XSS attacks when sanitize:true was configured. The target (marked 4.0.9-tuxcare.3) contains the upstream fix: a strict regex /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:24:43.977524+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.9 of marked. not_affected \u2014 The target repository (marked version 4.0.9-tuxcare.3) is not affected by CVE-2017-1000427. The vulnerability concerned missing validation of data: URI schemes in link sanitization, allowing XSS attacks when the sanitize option was enabled. The fix, which adds a check to reject data: URIs alongside javascript: and vbscript: schemes, is present in the target at src/helpers.js:77. This fix was au...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 The target repository (marked version 4.0.9-tuxcare.3) is not affected by CVE-2017-1000427. The vulnerability concerned missing validation of data: URI schemes in link sanitization, allowing XSS attacks when the sanitize option was enabled. The fix, which adds a check to reject data: URIs alongside javascript: and vbscript: schemes, is present in the target at src/helpers.js:77. This fix was au..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.9 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.9 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.9.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:46:00.060809+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.9 of marked. not_affected \u2014 The target repository at version 4.0.9 is not affected by CVE-2018-25110. The vulnerability was fixed in upstream version 0.3.18 (commit b15e42b6 by Jamie Davis, Feb 2018) which addressed catastrophic backtracking in four regular expressions. The current version 4.0.9 is significantly newer and already includes this fix from the upstream release. Runtime testing confirms the absence of the vuln...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 The target repository at version 4.0.9 is not affected by CVE-2018-25110. The vulnerability was fixed in upstream version 0.3.18 (commit b15e42b6 by Jamie Davis, Feb 2018) which addressed catastrophic backtracking in four regular expressions. The current version 4.0.9 is significantly newer and already includes this fix from the upstream release. Runtime testing confirms the absence of the vuln..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:39:00.054790+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.9 of marked. not_affected \u2014 CVE-2021-21306 (ReDoS via nested quantifier regex patterns in emphasis/strong parsing) is NOT present in target version 4.0.9-tuxcare.3. The vulnerable regex patterns (strong.middle, em.middle with nested (?:(?:(?!overlapSkip)...)*?) quantifiers) were replaced by upstream commit 7293251c in February 2021 (marked v2.0.0). The target uses the fixed emStrong tokenizer with delimiter-counting appro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21306 (ReDoS via nested quantifier regex patterns in emphasis/strong parsing) is NOT present in target version 4.0.9-tuxcare.3. The vulnerable regex patterns (strong.middle, em.middle with nested (?:(?:(?!overlapSkip)...)*?) quantifiers) were replaced by upstream commit 7293251c in February 2021 (marked v2.0.0). The target uses the fixed emStrong tokenizer with delimiter-counting appro..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 4.0.9 of marked, and is fixed in 4.0.9-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 4.0.9 of marked, and is fixed in 4.0.9-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.9 of marked, and is fixed in 4.0.9-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.9 of marked, and is fixed in 4.0.9-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 4.0.9 of marked. Version 4.0.9 is not vulnerable. Summary: The target repository (marked v4.0.9-tuxcare.3) is NOT vulnerable to CVE-2026-41680. The vulnerability requires the absence of tab preprocessing, which was introduced in v4.0.14. The target version predates this change and always converts tabs to spaces during preprocessing, preventing the infinite loop condition. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Version 4.0.9 is not vulnerable. Summary: The target repository (marked v4.0.9-tuxcare.3) is NOT vulnerable to CVE-2026-41680. The vulnerability requires the absence of tab preprocessing, which was introduced in v4.0.14. The target version predates this change and always converts tabs to spaces during preprocessing, preventing the infinite loop condition. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.9.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.9.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.9.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:36:00.054385+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 4.0.9 of marked. not_affected \u2014 GHSA-ch52-vgq2-943f (ReDoS in _label subrule) is not present in target version 4.0.9. The vulnerability was fixed in upstream commit 8594a066 (March 2018) and shipped in v0.7.0 (July 2019), well before TuxCare onboarded version 4.0.9. The fix added a negative lookahead `(?!\\s*\\])` to block._label regex to prevent catastrophic backtracking on whitespace-only labels. Target code at SHA 92c328f8 c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "impact_statement": "not_affected \u2014 GHSA-ch52-vgq2-943f (ReDoS in _label subrule) is not present in target version 4.0.9. The vulnerability was fixed in upstream commit 8594a066 (March 2018) and shipped in v0.7.0 (July 2019), well before TuxCare onboarded version 4.0.9. The fix added a negative lookahead `(?!\\s*\\])` to block._label regex to prevent catastrophic backtracking on whitespace-only labels. Target code at SHA 92c328f8 c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.9.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@4.0.9",
          "identifiers": {
            "purl": "pkg:npm/marked@4.0.9"
          }
        }
      ],
      "timestamp": "2026-11-04T08:32:00.134263+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 4.0.9 of marked. not_affected \u2014 The target (marked 4.0.9-tuxcare.3) is NOT affected by GHSA-xf5p-87ch-gxw2 (quadratic email regex ReDoS). The vulnerable pattern was fixed upstream in marked v0.7.0 (April 2019, commit be27472a by Anders Kaseorg), well before the 4.0.9 release. The fix changes the inline.gfm.text regex to only attempt email lookahead after a non-email character, preventing quadratic rescanning. The defense code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "impact_statement": "not_affected \u2014 The target (marked 4.0.9-tuxcare.3) is NOT affected by GHSA-xf5p-87ch-gxw2 (quadratic email regex ReDoS). The vulnerable pattern was fixed upstream in marked v0.7.0 (April 2019, commit be27472a by Anders Kaseorg), well before the 4.0.9 release. The fix changes the inline.gfm.text regex to only attempt email lookahead after a non-email character, preventing quadratic rescanning. The defense code..."
    }
  ]
}