{
  "@id": "urn:uuid:3252e51d-ca55-4bb3-a4d4-c6a3ca268889",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:44:06.387976+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2014-3743"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2015-1370"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2016-10531"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 0.2.10-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2018-25110"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:44:06.387976+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 0.2.10-tuxcare.2 of marked. not_affected \u2014 CVE-2021-21306 is a ReDoS vulnerability affecting marked v1.2.x's complex nested regex patterns with overlapSkip mechanisms. The target (v0.2.10, released 2013-11-02) uses a fundamentally different and simpler architecture without the vulnerable nested quantifier patterns that characterize v1.x. The vulnerability was introduced when marked evolved from v0.x's simple single-regex patterns to v1....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21306 is a ReDoS vulnerability affecting marked v1.2.x's complex nested regex patterns with overlapSkip mechanisms. The target (v0.2.10, released 2013-11-02) uses a fundamentally different and simpler architecture without the vulnerable nested quantifier patterns that characterize v1.x. The vulnerability was introduced when marked evolved from v0.x's simple single-regex patterns to v1...."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 is fixed in version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 0.2.10-tuxcare.2 of marked. Version 0.2.10 is not affected by CVE-2026-41680. The vulnerability exists only in versions 18.0.0-18.0.1 due to specific TypeScript Lexer implementation details. Version 0.2.10 uses a completely different JavaScript-based architecture where the code block parsing regex successfully matches and consumes the problematic input '\\t\\v\\n', preventing any infinite loop. Testing confirms the regex /^( {4}[^\\n]+\\n*)+/ consumes the entire preprocessed input '    \\v\\n' (6 characters), and the loop exits normally. The vulnerable code path from version 18.x is not present in this old version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Version 0.2.10 is not affected by CVE-2026-41680. The vulnerability exists only in versions 18.0.0-18.0.1 due to specific TypeScript Lexer implementation details. Version 0.2.10 uses a completely different JavaScript-based architecture where the code block parsing regex successfully matches and consumes the problematic input '\\t\\v\\n', preventing any infinite loop. Testing confirms the regex /^( {4}[^\\n]+\\n*)+/ consumes the entire preprocessed input '    \\v\\n' (6 characters), and the loop exits normally. The vulnerable code path from version 18.x is not present in this old version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 0.2.10-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 0.2.10-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 0.2.10-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f affects version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "action_statement": "Vulnerability GHSA-ch52-vgq2-943f affects version 0.2.10-tuxcare.2 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:44:00.151244+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 0.2.10-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 0.2.10-tuxcare.2 of marked.",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "action_statement": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 0.2.10-tuxcare.2 of marked."
    }
  ]
}