{
  "@id": "urn:uuid:3a803d4b-5b62-43b4-91f7-188724cada74",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:45:04.910133+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:36:00.054385+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 0.7.0 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier with two XSS vulnerabilities: (1) unsanitized language parameter in GFM code blocks allowing HTML injection, and (2) missing protocol validation allowing javascript:/vbscript:/data: URLs to bypass sanitize mode. The target (marked 0.7.0-tuxcare.1) is NOT AFFECTED because both upstream fixes are present: escape(lang, true) at line 958 preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier with two XSS vulnerabilities: (1) unsanitized language parameter in GFM code blocks allowing HTML injection, and (2) missing protocol validation allowing javascript:/vbscript:/data: URLs to bypass sanitize mode. The target (marked 0.7.0-tuxcare.1) is NOT AFFECTED because both upstream fixes are present: escape(lang, true) at line 958 preve..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:21:43.547685+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 0.7.0 of marked. not_affected \u2014 Target version 0.7.0 is not affected by CVE-2015-1370. The vbscript: XSS vulnerability was already fixed in upstream commit 3c191144 by Adam Baldwin, which shipped in the upstream release 0.7.0 before TuxCare onboarding (first TuxCare commit f3a92570). The fix blocks vbscript:, javascript:, and data: protocols in the cleanUrl function at lib/marked.js:1407, preventing malicious links from being...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 Target version 0.7.0 is not affected by CVE-2015-1370. The vbscript: XSS vulnerability was already fixed in upstream commit 3c191144 by Adam Baldwin, which shipped in the upstream release 0.7.0 before TuxCare onboarding (first TuxCare commit f3a92570). The fix blocks vbscript:, javascript:, and data: protocols in the cleanUrl function at lib/marked.js:1407, preventing malicious links from being..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 0.7.0 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 0.7.0 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:32:00.134263+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 0.7.0 of marked. not_affected \u2014 CVE-2016-10531 is NOT present in marked v0.7.0-tuxcare.1. The vulnerability involved a permissive regex `/&([#\\w]+);/g` in the `unescape` function that allowed malformed HTML entities (e.g., `&#58document;`) to bypass sanitization by omitting extra characters during decoding, enabling XSS via crafted JavaScript protocol handlers. The target contains the FIXED regex `/&(#(?:\\d+)|(?:#x[0-9A-Fa-f]...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-10531 is NOT present in marked v0.7.0-tuxcare.1. The vulnerability involved a permissive regex `/&([#\\w]+);/g` in the `unescape` function that allowed malformed HTML entities (e.g., `&#58document;`) to bypass sanitization by omitting extra characters during decoding, enabling XSS via crafted JavaScript protocol handlers. The target contains the FIXED regex `/&(#(?:\\d+)|(?:#x[0-9A-Fa-f]..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:27:24.320795+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 0.7.0 of marked. not_affected \u2014 CVE-2017-1000427 affects marked 0.3.6 and earlier, concerning an XSS vulnerability via data: URIs in the sanitize feature. The target (marked 0.7.0-tuxcare.1) contains the upstream fix (commit cd2f6f5b by Matt Austin) that adds data: protocol blocking to the sanitize feature at lib/marked.js:1407. The fix was shipped in the upstream release before TuxCare onboarding (confirmed via merge-base: f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-1000427 affects marked 0.3.6 and earlier, concerning an XSS vulnerability via data: URIs in the sanitize feature. The target (marked 0.7.0-tuxcare.1) contains the upstream fix (commit cd2f6f5b by Matt Austin) that adds data: protocol blocking to the sanitize feature at lib/marked.js:1407. The fix was shipped in the upstream release before TuxCare onboarding (confirmed via merge-base: f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 0.7.0 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 0.7.0 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 0.7.0.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:45:04.910133+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 0.7.0 of marked. not_affected \u2014 CVE-2018-25110 (ReDoS vulnerability in marked prior to 0.3.17) does not affect this target. The fix commit b15e42b6 (authored by Jamie Davis on Feb 26, 2018) was already present in the upstream version 0.7.0 before TuxCare onboarded it. All four vulnerable regex patterns (block.html closing tag, inline.tag, inline.nolink, and inline._inside) show the fixed versions that prevent catastrophic bac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-25110 (ReDoS vulnerability in marked prior to 0.3.17) does not affect this target. The fix commit b15e42b6 (authored by Jamie Davis on Feb 26, 2018) was already present in the upstream version 0.7.0 before TuxCare onboarded it. All four vulnerable regex patterns (block.html closing tag, inline.tag, inline.nolink, and inline._inside) show the fixed versions that prevent catastrophic bac..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:44:00.034778+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 0.7.0 of marked. not_affected \u2014 Target version 0.7.0 predates the vulnerable code architecture and is NOT affected by CVE-2021-21306. The ReDoS vulnerability exists only in versions 1.1.1 through 1.x (before v2.0.0) where the complex `overlapSkip` nested quantifier pattern was present. Version 0.7.0 uses a fundamentally different, simpler regex implementation without nested quantifiers that does not exhibit catastrophic backt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 Target version 0.7.0 predates the vulnerable code architecture and is NOT affected by CVE-2021-21306. The ReDoS vulnerability exists only in versions 1.1.1 through 1.x (before v2.0.0) where the complex `overlapSkip` nested quantifier pattern was present. Version 0.7.0 uses a fundamentally different, simpler regex implementation without nested quantifiers that does not exhibit catastrophic backt..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 0.7.0 of marked, and is fixed in 0.7.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 0.7.0 of marked, and is fixed in 0.7.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 0.7.0 of marked, and is fixed in 0.7.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 0.7.0 of marked, and is fixed in 0.7.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 0.7.0 of marked. Target version 0.7.0 is not affected by CVE-2026-41680. The vulnerability exists specifically in marked versions 18.0.0-18.0.1 due to architectural changes in the modern TypeScript codebase. Version 0.7.0 uses a fundamentally different single-file JavaScript architecture where all pattern matches properly consume input characters, preventing the infinite loop condition. Empirical testing confirms the malicious input `\\t\\v\\n` is parsed successfully without triggering an infinite loop, producing the correct output `<pre><code>\\v</code></pre>`.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Target version 0.7.0 is not affected by CVE-2026-41680. The vulnerability exists specifically in marked versions 18.0.0-18.0.1 due to architectural changes in the modern TypeScript codebase. Version 0.7.0 uses a fundamentally different single-file JavaScript architecture where all pattern matches properly consume input characters, preventing the infinite loop condition. Empirical testing confirms the malicious input `\\t\\v\\n` is parsed successfully without triggering an infinite loop, producing the correct output `<pre><code>\\v</code></pre>`."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 0.7.0.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 0.7.0.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 0.7.0.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:36:59.454202+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 0.7.0 of marked. not_affected \u2014 The target version 0.7.0-tuxcare.1 is NOT affected by GHSA-ch52-vgq2-943f (ReDoS in `_label` regex). The vulnerability was fixed in upstream commit e987a4df, which was merged via PR #1515 (\"link-label-security\") before the 0.7.0 release. The CVE advisory recommends \"Upgrade to version 0.7.0 or later\", confirming that 0.7.0 is the first fixed version. The fix modified the `_label` regex from the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "impact_statement": "not_affected \u2014 The target version 0.7.0-tuxcare.1 is NOT affected by GHSA-ch52-vgq2-943f (ReDoS in `_label` regex). The vulnerability was fixed in upstream commit e987a4df, which was merged via PR #1515 (\"link-label-security\") before the 0.7.0 release. The CVE advisory recommends \"Upgrade to version 0.7.0 or later\", confirming that 0.7.0 is the first fixed version. The fix modified the `_label` regex from the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 0.7.0.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.7.0",
          "identifiers": {
            "purl": "pkg:npm/marked@0.7.0"
          }
        }
      ],
      "timestamp": "2026-11-04T08:33:00.106702+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 0.7.0 of marked. not_affected \u2014 Target version 0.7.0-tuxcare.1 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS in email address evaluation). The vulnerable quadratic-time regex pattern in inline.text was fixed by upstream commit be27472a (Anders Kaseorg, 2019-04-03) which shipped in the upstream 0.7.0 release before TuxCare onboarding. The CVE affects versions 0.3.14-0.6.2; the fix was released in 0.6.2. Target version 0.7.0 co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "impact_statement": "not_affected \u2014 Target version 0.7.0-tuxcare.1 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS in email address evaluation). The vulnerable quadratic-time regex pattern in inline.text was fixed by upstream commit be27472a (Anders Kaseorg, 2019-04-03) which shipped in the upstream 0.7.0 release before TuxCare onboarding. The CVE affects versions 0.3.14-0.6.2; the fix was released in 0.6.2. Target version 0.7.0 co..."
    }
  ]
}