{ "@id": "urn:uuid:4136fdc9-5c82-4bd7-9bae-85460826c616", "role": "Document Creator", "author": "https://tuxcare.com", "version": 11, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:48:18.117175+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:36:00.054385+00:00", "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.12 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0 with XSS vulnerabilities via JavaScript URLs and GFM Codeblocks. The target version 4.0.12 contains all upstream fixes that shipped in v0.3.1 (January 2014). The vulnerable patterns are not present: (1) JavaScript URLs are sanitized via cleanUrl() which decodes HTML entities and blocks javascript:/vbscript:/data: protocols, and (2) GFM Codeblock cont...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3743" }, "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions \u22640.3.0 with XSS vulnerabilities via JavaScript URLs and GFM Codeblocks. The target version 4.0.12 contains all upstream fixes that shipped in v0.3.1 (January 2014). The vulnerable patterns are not present: (1) JavaScript URLs are sanitized via cleanUrl() which decodes HTML entities and blocks javascript:/vbscript:/data: protocols, and (2) GFM Codeblock cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:21:30.402489+00:00", "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.12 of marked. not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier where vbscript: protocol URLs bypass XSS sanitization even when sanitize:true is set. The target (marked v4.0.12) contains the upstream fix (commit 3c19114) authored by Adam Baldwin that adds vbscript: to the protocol blacklist in the cleanUrl function. The fix is present at src/helpers.js:76 and properly blocks vbscript: URIs when sanitiz...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1370" }, "impact_statement": "not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier where vbscript: protocol URLs bypass XSS sanitization even when sanitize:true is set. The target (marked v4.0.12) contains the upstream fix (commit 3c19114) authored by Adam Baldwin that adds vbscript: to the protocol blacklist in the cleanUrl function. The fix is present at src/helpers.js:76 and properly blocks vbscript: URIs when sanitiz..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.12 of marked.", "vulnerability": { "name": "CVE-2015-8854" }, "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.12 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:32:00.134263+00:00", "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.12 of marked. not_affected \u2014 The target (marked 4.0.12) is not affected by CVE-2016-10531. The vulnerability was fixed in upstream commit 2cff8597 (May 2015) which tightened the HTML entity regex in the unescape function from /&([#\\w]+);/g to /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig. This fix prevents malformed entities like javascript:document from being decoded to javascript:document. The fix shipped in the upstre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10531" }, "impact_statement": "not_affected \u2014 The target (marked 4.0.12) is not affected by CVE-2016-10531. The vulnerability was fixed in upstream commit 2cff8597 (May 2015) which tightened the HTML entity regex in the unescape function from /&([#\\w]+);/g to /&(#(?:\\d+)|(?:#x[0-9A-Fa-f]+)|(?:\\w+));?/ig. This fix prevents malformed entities like javascript:document from being decoded to javascript:document. The fix shipped in the upstre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:29:00.146754+00:00", "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.12 of marked. not_affected \u2014 The target (marked 4.0.12) contains the fix for CVE-2017-1000427 (data: URI XSS), but the protection is disabled by default. The fix code exists in src/helpers.js:76, blocking data: protocol URIs when the sanitize option is true. However, sanitize defaults to false (src/defaults.js:14). The fix was authored by upstream maintainer Matt Austin (commit cd2f6f5b, 2017-01-19) and shipped in the upst...", "vulnerability": { "name": "CVE-2017-1000427" }, "impact_statement": "not_affected \u2014 The target (marked 4.0.12) contains the fix for CVE-2017-1000427 (data: URI XSS), but the protection is disabled by default. The fix code exists in src/helpers.js:76, blocking data: protocol URIs when the sanitize option is true. However, sanitize defaults to false (src/defaults.js:14). The fix was authored by upstream maintainer Matt Austin (commit cd2f6f5b, 2017-01-19) and shipped in the upst..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.12 of marked.", "vulnerability": { "name": "CVE-2017-16114" }, "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.12 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.12.", "vulnerability": { "name": "CVE-2017-17461" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:48:18.117175+00:00", "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.12 of marked. not_affected \u2014 CVE-2018-25110 affects marked versions prior to 0.3.17 due to catastrophic backtracking in four regular expressions. The target version 4.0.12 already contains the upstream fix committed by Jamie Davis on Feb 26, 2018 (commit b15e42b67c). All four vulnerable regex patterns (block.pedantic.html closing tag, inline.tag, inline.nolink, inline._inside) have been fixed or refactored. The fix shipped...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-25110" }, "impact_statement": "not_affected \u2014 CVE-2018-25110 affects marked versions prior to 0.3.17 due to catastrophic backtracking in four regular expressions. The target version 4.0.12 already contains the upstream fix committed by Jamie Davis on Feb 26, 2018 (commit b15e42b67c). All four vulnerable regex patterns (block.pedantic.html closing tag, inline.tag, inline.nolink, inline._inside) have been fixed or refactored. The fix shipped..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:41:30.547150+00:00", "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.12 of marked. not_affected \u2014 CVE-2021-21306 (ReDoS in emphasis/strong parsing) is NOT present in marked v4.0.12. The vulnerable separate em() and strong() methods with catastrophic backtracking regex were replaced by the fixed emStrong() method in upstream v2.0.0. Since v4.0.12 is after v2.0.0, this version already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21306" }, "impact_statement": "not_affected \u2014 CVE-2021-21306 (ReDoS in emphasis/strong parsing) is NOT present in marked v4.0.12. The vulnerable separate em() and strong() methods with catastrophic backtracking regex were replaced by the fixed emStrong() method in upstream v2.0.0. Since v4.0.12 is after v2.0.0, this version already contains the upstream fix." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2022-21680 affects version 4.0.12 of marked.", "vulnerability": { "name": "CVE-2022-21680" }, "action_statement": "Vulnerability CVE-2022-21680 affects version 4.0.12 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.12 of marked.", "vulnerability": { "name": "CVE-2022-21681" }, "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.12 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2026-41680 affects version 4.0.12 of marked.", "vulnerability": { "name": "CVE-2026-41680" }, "action_statement": "Vulnerability CVE-2026-41680 affects version 4.0.12 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.12.", "vulnerability": { "name": "GHSA-32vw-r77c-gm67" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.12.", "vulnerability": { "name": "GHSA-7m7q-q53v-j47v" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.12.", "vulnerability": { "name": "GHSA-8wp3-cp9v-44fm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:38:50.475928+00:00", "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 4.0.12 of marked. not_affected \u2014 Target version 4.0.12 is NOT vulnerable to GHSA-ch52-vgq2-943f. The ReDoS vulnerability in the `_label` subrule was fixed in upstream v0.7.0 (July 2019) by changing the regex pattern from the vulnerable `\\\\[\\[\\]]?` to the safe `\\\\.` form. Version 4.0.12 inherits this fix from upstream and contains the secure pattern. No TuxCare backport was required as the fix predates the target version by years.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-ch52-vgq2-943f" }, "impact_statement": "not_affected \u2014 Target version 4.0.12 is NOT vulnerable to GHSA-ch52-vgq2-943f. The ReDoS vulnerability in the `_label` subrule was fixed in upstream v0.7.0 (July 2019) by changing the regex pattern from the vulnerable `\\\\[\\[\\]]?` to the safe `\\\\.` form. Version 4.0.12 inherits this fix from upstream and contains the secure pattern. No TuxCare backport was required as the fix predates the target version by years." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.12.", "vulnerability": { "name": "GHSA-wjmf-58vc-xqjr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.12", "identifiers": { "purl": "pkg:npm/marked@4.0.12" } } ], "timestamp": "2026-11-04T08:33:00.106702+00:00", "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 4.0.12 of marked. not_affected \u2014 The target (marked 4.0.12) is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS via quadratic email scanning). The vulnerability was fixed in upstream version 0.6.2 by commit be27472a (authored by Anders Kaseorg), which modified the inline.gfm.text regex to prevent quadratic rescanning. Since 4.0.12 > 0.6.2, the fix was already present in the upstream release that TuxCare onboarded. The defensive patt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-xf5p-87ch-gxw2" }, "impact_statement": "not_affected \u2014 The target (marked 4.0.12) is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS via quadratic email scanning). The vulnerability was fixed in upstream version 0.6.2 by commit be27472a (authored by Anders Kaseorg), which modified the inline.gfm.text regex to prevent quadratic rescanning. Since 4.0.12 > 0.6.2, the fix was already present in the upstream release that TuxCare onboarded. The defensive patt..." } ] }