{
  "@id": "urn:uuid:85a54a65-a8ec-4a88-831b-b9a9c01b533e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:39:00.166707+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:36:59.454202+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 does not affect version 2.0.1 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0, addressing XSS via entity-encoded JavaScript URLs. The target (marked 2.0.1-tuxcare.1) is not affected because the upstream fix was already present in the release. The vulnerable pattern\u2014missing HTML entity decoding before JavaScript protocol checks\u2014does not exist. The fix (commit 613bf6ac by Christopher Jeffrey) adds unescape() function and two-sta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3743"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0, addressing XSS via entity-encoded JavaScript URLs. The target (marked 2.0.1-tuxcare.1) is not affected because the upstream fix was already present in the release. The vulnerable pattern\u2014missing HTML entity decoding before JavaScript protocol checks\u2014does not exist. The fix (commit 613bf6ac by Christopher Jeffrey) adds unescape() function and two-sta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:23:00.049758+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 does not affect version 2.0.1 of marked. not_affected \u2014 CVE-2015-1370 describes an XSS vulnerability in marked versions \u22640.3.2 where vbscript: protocol URIs bypass sanitization. The target (marked 2.0.1-tuxcare.1) already contains the upstream fix commit 3c191144 which adds vbscript: protocol detection to the cleanUrl() function. This fix was present in the upstream release v2.0.1 that TuxCare onboarded, predating any TuxCare modifications. The vuln...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-1370"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-1370 describes an XSS vulnerability in marked versions \u22640.3.2 where vbscript: protocol URIs bypass sanitization. The target (marked 2.0.1-tuxcare.1) already contains the upstream fix commit 3c191144 which adds vbscript: protocol detection to the cleanUrl() function. This fix was present in the upstream release v2.0.1 that TuxCare onboarded, predating any TuxCare modifications. The vuln..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 affects version 2.0.1 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      },
      "action_statement": "Vulnerability CVE-2015-8854 affects version 2.0.1 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:34:00.156708+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 does not affect version 2.0.1 of marked. not_affected \u2014 The target (marked v2.0.1-tuxcare.1) is not affected by CVE-2016-10531. The vulnerability was fixed in upstream marked v0.3.6 (May 2015) by changing the unescape regex from the overly-permissive /&([#\\w]+);/g to the strict /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig. This fix was already present in the upstream v2.0.1 release that TuxCare onboarded, making it an upstream fix rather than a TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10531"
      },
      "impact_statement": "not_affected \u2014 The target (marked v2.0.1-tuxcare.1) is not affected by CVE-2016-10531. The vulnerability was fixed in upstream marked v0.3.6 (May 2015) by changing the unescape regex from the overly-permissive /&([#\\w]+);/g to the strict /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig. This fix was already present in the upstream v2.0.1 release that TuxCare onboarded, making it an upstream fix rather than a TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:27:24.320795+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 2.0.1 of marked. not_affected \u2014 CVE-2017-1000427 affects marked 0.3.6 and earlier due to missing data: URI sanitization. The target (marked 2.0.1-tuxcare.1) contains the upstream fix added in January 2017 by Matt Austin (commit cd2f6f5b). The fix adds data: URI protocol checking to the cleanUrl() sanitization function in src/helpers.js line 76, preventing XSS when the sanitize option is enabled. This fix was already present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-1000427 affects marked 0.3.6 and earlier due to missing data: URI sanitization. The target (marked 2.0.1-tuxcare.1) contains the upstream fix added in January 2017 by Matt Austin (commit cd2f6f5b). The fix adds data: URI protocol checking to the cleanUrl() sanitization function in src/helpers.js line 76, preventing XSS when the sanitize option is enabled. This fix was already present i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 affects version 2.0.1 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      },
      "action_statement": "Vulnerability CVE-2017-16114 affects version 2.0.1 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:05:00.223594+00:00",
      "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 2.0.1.",
      "vulnerability": {
        "name": "CVE-2017-17461"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:46:00.060809+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 does not affect version 2.0.1 of marked. not_affected \u2014 Target version 2.0.1 is NOT AFFECTED by CVE-2018-25110. The vulnerability was fixed in upstream version 0.3.17 (commit b15e42b6, Feb 2018) and version 2.0.1 (released later) already contains all four regex fixes. The vulnerable patterns that caused catastrophic backtracking have been replaced with restricted character classes that eliminate overlapping match possibilities. When TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-25110"
      },
      "impact_statement": "not_affected \u2014 Target version 2.0.1 is NOT AFFECTED by CVE-2018-25110. The vulnerability was fixed in upstream version 0.3.17 (commit b15e42b6, Feb 2018) and version 2.0.1 (released later) already contains all four regex fixes. The vulnerable patterns that caused catastrophic backtracking have been replaced with restricted character classes that eliminate overlapping match possibilities. When TuxCare onboarde..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:40:12.229007+00:00",
      "status_notes": "Vulnerability CVE-2021-21306 does not affect version 2.0.1 of marked. not_affected \u2014 CVE-2021-21306 is a Regular expression Denial of Service (ReDoS) vulnerability in the marked library's emphasis/strong tokenizer. The vulnerability was caused by catastrophic backtracking in nested quantifier patterns within the `em.middle` and `strong.middle` regexes. The target repository (marked v2.0.1-tuxcare.1) is NOT AFFECTED because the fix was already present in upstream v2.0.0, which p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21306"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21306 is a Regular expression Denial of Service (ReDoS) vulnerability in the marked library's emphasis/strong tokenizer. The vulnerability was caused by catastrophic backtracking in nested quantifier patterns within the `em.middle` and `strong.middle` regexes. The target repository (marked v2.0.1-tuxcare.1) is NOT AFFECTED because the fix was already present in upstream v2.0.0, which p..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:13:00.090753+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 affects version 2.0.1 of marked, and is fixed in 2.0.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      },
      "action_statement": "Vulnerability CVE-2022-21680 affects version 2.0.1 of marked, and is fixed in 2.0.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:39:00.166707+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 affects version 2.0.1 of marked, and is fixed in 2.0.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      },
      "action_statement": "Vulnerability CVE-2022-21681 affects version 2.0.1 of marked, and is fixed in 2.0.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:07:00.152092+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 affects version 2.0.1 of marked.",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "action_statement": "Vulnerability CVE-2026-41680 affects version 2.0.1 of marked."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 2.0.1.",
      "vulnerability": {
        "name": "GHSA-32vw-r77c-gm67"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 2.0.1.",
      "vulnerability": {
        "name": "GHSA-7m7q-q53v-j47v"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 2.0.1.",
      "vulnerability": {
        "name": "GHSA-8wp3-cp9v-44fm"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:38:00.054058+00:00",
      "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 2.0.1 of marked. not_affected \u2014 The ReDoS vulnerability in the _label regex pattern (GHSA-ch52-vgq2-943f) was fixed in upstream version 0.7.0 by commit 0ee3aa98 authored by Tony Brix on 2019-07-04. The target version 2.0.1-tuxcare.1 contains this fix as it descended from the upstream release. The vulnerable pattern \\\\[\\[\\]]? was replaced with \\\\. which prevents catastrophic backtracking. Since the fix was already present in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-ch52-vgq2-943f"
      },
      "impact_statement": "not_affected \u2014 The ReDoS vulnerability in the _label regex pattern (GHSA-ch52-vgq2-943f) was fixed in upstream version 0.7.0 by commit 0ee3aa98 authored by Tony Brix on 2019-07-04. The target version 2.0.1-tuxcare.1 contains this fix as it descended from the upstream release. The vulnerable pattern \\\\[\\[\\]]? was replaced with \\\\. which prevents catastrophic backtracking. Since the fix was already present in t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:06:00.161896+00:00",
      "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 2.0.1.",
      "vulnerability": {
        "name": "GHSA-wjmf-58vc-xqjr"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@2.0.1",
          "identifiers": {
            "purl": "pkg:npm/marked@2.0.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:35:03.436701+00:00",
      "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 2.0.1 of marked. not_affected \u2014 The target version 2.0.1 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS in email address parsing). The vulnerable regex patterns were fixed by upstream developers Anders Kaseorg and Jamie Davis in commits be27472a and b15e42b6, which shipped in upstream releases prior to v0.6.2. Since the target version 2.0.1 is significantly newer than the affected version range (0.3.14 to < 0.6.2), these fixes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-xf5p-87ch-gxw2"
      },
      "impact_statement": "not_affected \u2014 The target version 2.0.1 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS in email address parsing). The vulnerable regex patterns were fixed by upstream developers Anders Kaseorg and Jamie Davis in commits be27472a and b15e42b6, which shipped in upstream releases prior to v0.6.2. Since the target version 2.0.1 is significantly newer than the affected version range (0.3.14 to < 0.6.2), these fixes..."
    }
  ]
}