{
  "@id": "urn:uuid:373bc276-6986-4b59-a8e8-8923d1374666",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T09:32:26.454745+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-04T08:35:03.436701+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 0.3.19 of marked. not_affected \u2014 The target (marked v0.3.19-tuxcare.2) is NOT affected by CVE-2014-3743. The vulnerability affected versions 0.3.0 and earlier, with fixes applied in v0.3.1. Both attack vectors (JavaScript URLs and GFM Codeblocks XSS) were fixed by upstream commits 613bf6ac and 5e716661, authored by Christopher Jeffrey (original maintainer), which shipped in the upstream release before TuxCare onboarding. The t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 The target (marked v0.3.19-tuxcare.2) is NOT affected by CVE-2014-3743. The vulnerability affected versions 0.3.0 and earlier, with fixes applied in v0.3.1. Both attack vectors (JavaScript URLs and GFM Codeblocks XSS) were fixed by upstream commits 613bf6ac and 5e716661, authored by Christopher Jeffrey (original maintainer), which shipped in the upstream release before TuxCare onboarding. The t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-04T08:21:43.547685+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 0.3.19 of marked. not_affected \u2014 The target repository (marked v0.3.19-tuxcare.2) is NOT affected by CVE-2015-1370. The vulnerability involved XSS via vbscript: protocol URLs that bypassed the sanitize:true setting in marked versions 0.3.2 and earlier. The upstream fix (commit 3c191144 by Adam Baldwin) added a check to block vbscript: protocol URLs in the Renderer.prototype.link function. This fix was already present in the up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 The target repository (marked v0.3.19-tuxcare.2) is NOT affected by CVE-2015-1370. The vulnerability involved XSS via vbscript: protocol URLs that bypassed the sanitize:true setting in marked versions 0.3.2 and earlier. The upstream fix (commit 3c191144 by Adam Baldwin) added a check to block vbscript: protocol URLs in the Renderer.prototype.link function. This fix was already present in the up..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 0.3.19 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 0.3.19 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-04T08:31:00.099165+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 0.3.19 of marked. not_affected \u2014 CVE-2016-10531: XSS vulnerability in link components when sanitize:true is configured. The vulnerability was fixed in upstream marked v0.3.6 (May 2015) by changing the unescape function's regex pattern from the loose /&([#\\w]+);/g to the strict /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/g. The target repository (marked 0.3.19-tuxcare.2) contains this fix, which was already present in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-10531: XSS vulnerability in link components when sanitize:true is configured. The vulnerability was fixed in upstream marked v0.3.6 (May 2015) by changing the unescape function's regex pattern from the loose /&([#\\w]+);/g to the strict /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/g. The target repository (marked 0.3.19-tuxcare.2) contains this fix, which was already present in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-04T08:27:00.040224+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 0.3.19 of marked. not_affected \u2014 CVE-2017-1000427 is NOT present in marked 0.3.19-tuxcare.2. The vulnerability (XSS via data: URI in links when sanitize mode is enabled) was fixed by upstream commit cd2f6f5b7 authored by Matt Austin on 2017-01-19, which added data: URI blocking to the sanitize code path. This fix was already present in the upstream 0.3.19 release before TuxCare onboarded it (first TuxCare commit c1cb8885c \"PF:...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-1000427 is NOT present in marked 0.3.19-tuxcare.2. The vulnerability (XSS via data: URI in links when sanitize mode is enabled) was fixed by upstream commit cd2f6f5b7 authored by Matt Austin on 2017-01-19, which added data: URI blocking to the sanitize code path. This fix was already present in the upstream 0.3.19 release before TuxCare onboarded it (first TuxCare commit c1cb8885c \"PF:..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 0.3.19 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 0.3.19 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 0.3.19.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-04T08:45:04.910133+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 0.3.19 of marked. not_affected \u2014 Target version 0.3.19 is not affected by CVE-2018-25110. The vulnerability involves catastrophic backtracking in four regular expressions (block.html closing, inline.tag, inline.nolink, inline._inside) that allowed ReDoS attacks via crafted markdown input with repetitive structures. The upstream fix by Jamie Davis (commit b15e42b6, 2018-02-26) was included in marked v0.3.18 and is present in th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 Target version 0.3.19 is not affected by CVE-2018-25110. The vulnerability involves catastrophic backtracking in four regular expressions (block.html closing, inline.tag, inline.nolink, inline._inside) that allowed ReDoS attacks via crafted markdown input with repetitive structures. The upstream fix by Jamie Davis (commit b15e42b6, 2018-02-26) was included in marked v0.3.18 and is present in th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-04T08:45:04.910133+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 0.3.19 of marked. not_affected \u2014 Version 0.3.19 is NOT AFFECTED by CVE-2021-21306. The vulnerable code pattern (overlapSkip nested quantifier regex) was introduced in v1.1.1 (July 2020), 2.5 years AFTER v0.3.19 was released (March 2018). v0.3.19 uses simpler regex patterns without the catastrophic backtracking behavior. Empirical testing confirms no ReDoS behavior with pathological inputs (101 delimiters complete in <10ms). Af...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 Version 0.3.19 is NOT AFFECTED by CVE-2021-21306. The vulnerable code pattern (overlapSkip nested quantifier regex) was introduced in v1.1.1 (July 2020), 2.5 years AFTER v0.3.19 was released (March 2018). v0.3.19 uses simpler regex patterns without the catastrophic backtracking behavior. Empirical testing confirms no ReDoS behavior with pathological inputs (101 delimiters complete in <10ms). Af..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-05T09:32:26.454745+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 0.3.19 of marked, and is fixed in 0.3.19-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 0.3.19 of marked, and is fixed in 0.3.19-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-05T09:32:26.454745+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 0.3.19 of marked, and is fixed in 0.3.19-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 0.3.19 of marked, and is fixed in 0.3.19-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 0.3.19 of marked. Target version 0.3.19-tuxcare.1 is not affected by CVE-2026-41680. The vulnerability affects marked versions 18.0.0-18.0.1 where specific whitespace input triggers an infinite loop. Empirical testing confirms version 0.3.19 successfully parses the CVE's trigger input (\\t\\v\\n) without entering an infinite loop. The architecture differs fundamentally from version 18.x - the parsing logic in 0.3.19 successfully consumes the problematic input, preventing the unbounded loop iteration that characterizes the vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Target version 0.3.19-tuxcare.1 is not affected by CVE-2026-41680. The vulnerability affects marked versions 18.0.0-18.0.1 where specific whitespace input triggers an infinite loop. Empirical testing confirms version 0.3.19 successfully parses the CVE's trigger input (\\t\\v\\n) without entering an infinite loop. The architecture differs fundamentally from version 18.x - the parsing logic in 0.3.19 successfully consumes the problematic input, preventing the unbounded loop iteration that characterizes the vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 0.3.19.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 0.3.19.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 0.3.19.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f affects version 0.3.19 of marked.",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "action_statement": "Vulnerability GHSA-ch52-vgq2-943f affects version 0.3.19 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-11-02T18:07:00.152092+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 0.3.19.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.3.19",
          "identifiers": {
            "purl": "pkg:npm/marked@0.3.19"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 0.3.19 of marked, and is fixed in 0.3.19-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "action_statement": "Vulnerability GHSA-xf5p-87ch-gxw2 affects version 0.3.19 of marked, and is fixed in 0.3.19-tuxcare.1."
    }
  ]
}