{
  "@id": "urn:uuid:adf05fd0-2795-4c9a-80ff-59ee764e5a83",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:45:41.566773+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highlight.js@11.5.1",
          "identifiers": {
            "purl": "pkg:npm/highlight.js@11.5.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:41:55.496822+00:00",
      "status_notes": "Vulnerability CVE-2020-26237 does not affect version 11.5.1 of highlight.js. not_affected \u2014 Target version 11.5.1 is not affected by CVE-2020-26237. The vulnerability (prototype pollution via user-controlled language names accessing Object.prototype properties) was fixed in upstream highlight.js in July 2020 (commit e6f75d01). The fix replaced plain object literals with null-prototype objects for the `languages` and `aliases` dictionaries, preventing prototype chain lookups. This fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26237"
      },
      "impact_statement": "not_affected \u2014 Target version 11.5.1 is not affected by CVE-2020-26237. The vulnerability (prototype pollution via user-controlled language names accessing Object.prototype properties) was fixed in upstream highlight.js in July 2020 (commit e6f75d01). The fix replaced plain object literals with null-prototype objects for the `languages` and `aliases` dictionaries, preventing prototype chain lookups. This fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highlight.js@11.5.1",
          "identifiers": {
            "purl": "pkg:npm/highlight.js@11.5.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:45:41.566773+00:00",
      "status_notes": "Vulnerability GHSA-7wwv-vh3v-89cq does not affect version 11.5.1 of highlight.js. not_affected \u2014 Target version 11.5.1 is NOT affected by GHSA-7wwv-vh3v-89cq. The ReDoS vulnerabilities affecting versions prior to 10.4.1 were fixed by upstream maintainer Josh Goebel in commit 10dcd471 (December 2020). Version 11.5.1 was released 16 months later (April 2022) and inherits all fixes from 10.4.1. The vulnerable regex patterns with exponential/polynomial backtracking have been removed and replac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7wwv-vh3v-89cq"
      },
      "impact_statement": "not_affected \u2014 Target version 11.5.1 is NOT affected by GHSA-7wwv-vh3v-89cq. The ReDoS vulnerabilities affecting versions prior to 10.4.1 were fixed by upstream maintainer Josh Goebel in commit 10dcd471 (December 2020). Version 11.5.1 was released 16 months later (April 2022) and inherits all fixes from 10.4.1. The vulnerable regex patterns with exponential/polynomial backtracking have been removed and replac..."
    }
  ]
}