{ "@id": "urn:uuid:4f6bbc2a-1134-4c33-abf9-c40e2755682f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:44:06.387976+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:36:59.454202+00:00", "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.5 of marked. not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier due to XSS via entity-encoded JavaScript URLs that bypass sanitization. The target version 4.0.5 is NOT affected because the upstream fix (commits 904c71b7 and 613bf6ac by Christopher Jeffrey) was already present in the release that TuxCare onboarded. The cleanUrl function properly decodes HTML entities (including :) and blocks javas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3743" }, "impact_statement": "not_affected \u2014 CVE-2014-3743 affects marked versions 0.3.0 and earlier due to XSS via entity-encoded JavaScript URLs that bypass sanitization. The target version 4.0.5 is NOT affected because the upstream fix (commits 904c71b7 and 613bf6ac by Christopher Jeffrey) was already present in the release that TuxCare onboarded. The cleanUrl function properly decodes HTML entities (including :) and blocks javas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:22:00.047776+00:00", "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.5 of marked. not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier, allowing XSS via vbscript: protocol in links even when sanitize:true is set. The target (marked 4.0.5) is NOT AFFECTED because the upstream fix (commit 3c191144 by Adam Baldwin, 2015-01-22) was already present in the upstream release when TuxCare onboarded version 4.0.5. The fix blocks vbscript: protocol alongside javascript: and data: pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1370" }, "impact_statement": "not_affected \u2014 CVE-2015-1370 affects marked versions 0.3.2 and earlier, allowing XSS via vbscript: protocol in links even when sanitize:true is set. The target (marked 4.0.5) is NOT AFFECTED because the upstream fix (commit 3c191144 by Adam Baldwin, 2015-01-22) was already present in the upstream release when TuxCare onboarded version 4.0.5. The fix blocks vbscript: protocol alongside javascript: and data: pr..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.5 of marked.", "vulnerability": { "name": "CVE-2015-8854" }, "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.5 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:31:00.099165+00:00", "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.5 of marked. not_affected \u2014 CVE-2016-10531 affects the `unescape` function in marked's HTML entity processing. The vulnerability allowed XSS attacks via malformed HTML entities in link URIs (e.g., `javascript:alert`). The target repository (marked 4.0.5) contains the upstream fix that restricts the entity regex to match only properly-formed entities. Both fix commits (2cff859 from 2015-05-19 and 31c7799 from 2016-07-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10531" }, "impact_statement": "not_affected \u2014 CVE-2016-10531 affects the `unescape` function in marked's HTML entity processing. The vulnerability allowed XSS attacks via malformed HTML entities in link URIs (e.g., `javascript:alert`). The target repository (marked 4.0.5) contains the upstream fix that restricts the entity regex to match only properly-formed entities. Both fix commits (2cff859 from 2015-05-19 and 31c7799 from 2016-07-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:26:00.080994+00:00", "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.5 of marked. not_affected \u2014 CVE-2017-1000427 affects marked version 0.3.6 and earlier. The target (marked 4.0.5) contains the upstream fix (commit cd2f6f5b by Matt Austin) that blocks data: URIs when the `sanitize: true` option is enabled. The fix was already present in the upstream release that TuxCare onboarded. While the defense requires configuration to activate (sanitize defaults to false), the fix code exists in the...", "vulnerability": { "name": "CVE-2017-1000427" }, "impact_statement": "not_affected \u2014 CVE-2017-1000427 affects marked version 0.3.6 and earlier. The target (marked 4.0.5) contains the upstream fix (commit cd2f6f5b by Matt Austin) that blocks data: URIs when the `sanitize: true` option is enabled. The fix was already present in the upstream release that TuxCare onboarded. While the defense requires configuration to activate (sanitize defaults to false), the fix code exists in the..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.5 of marked.", "vulnerability": { "name": "CVE-2017-16114" }, "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.5 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.5.", "vulnerability": { "name": "CVE-2017-17461" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:44:06.387976+00:00", "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.5 of marked. not_affected \u2014 CVE-2018-25110 is NOT present in the target. The vulnerability was fixed in upstream commit b15e42b67cec9ded8505e9d68bb8741ad7a9590d (by Jamie Davis, Feb 2018) which shipped in marked v0.3.17. The target version 4.0.5 (released Nov 2021) includes this fix as part of its upstream release. All four vulnerable regex patterns have been refactored with non-overlapping character classes to prevent ca...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-25110" }, "impact_statement": "not_affected \u2014 CVE-2018-25110 is NOT present in the target. The vulnerability was fixed in upstream commit b15e42b67cec9ded8505e9d68bb8741ad7a9590d (by Jamie Davis, Feb 2018) which shipped in marked v0.3.17. The target version 4.0.5 (released Nov 2021) includes this fix as part of its upstream release. All four vulnerable regex patterns have been refactored with non-overlapping character classes to prevent ca..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:39:00.054790+00:00", "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.5 of marked. not_affected \u2014 Target marked 4.0.5 is not affected by CVE-2021-21306 (ReDoS). The vulnerability was caused by vulnerable regex patterns with nested quantifiers in the em/strong tokenizers (inline.em.middle and inline.strong.middle) that enabled catastrophic backtracking. The fix merged these into a unified emStrong tokenizer with simplified patterns. This fix was authored by Trevor Buckner (upstream) in commi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21306" }, "impact_statement": "not_affected \u2014 Target marked 4.0.5 is not affected by CVE-2021-21306 (ReDoS). The vulnerability was caused by vulnerable regex patterns with nested quantifiers in the em/strong tokenizers (inline.em.middle and inline.strong.middle) that enabled catastrophic backtracking. The fix merged these into a unified emStrong tokenizer with simplified patterns. This fix was authored by Trevor Buckner (upstream) in commi..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21680 affects version 4.0.5 of marked.", "vulnerability": { "name": "CVE-2022-21680" }, "action_statement": "Vulnerability CVE-2022-21680 affects version 4.0.5 of marked." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.5 of marked.", "vulnerability": { "name": "CVE-2022-21681" }, "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.5 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41680 does not affect version 4.0.5 of marked. CVE-2026-41680 does NOT affect marked v4.0.5. The vulnerability was introduced in v18.0.0 (5 years and 1,372 commits later) by changes to the tokenizer implementation. Empirical testing confirms v4.0.5 successfully parses all variations of the CVE input (\\t\\v\\n and related whitespace sequences) without triggering infinite loops. While v4.0.5 lacks the proactive loop-progress tracking added in the v18.0.2 patch, its tokenizer implementation successfully advances on all tested inputs, preventing unbounded memory consumption. This is Rule 5 Type A2: input is received but no path reaches the goal.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41680" }, "impact_statement": "CVE-2026-41680 does NOT affect marked v4.0.5. The vulnerability was introduced in v18.0.0 (5 years and 1,372 commits later) by changes to the tokenizer implementation. Empirical testing confirms v4.0.5 successfully parses all variations of the CVE input (\\t\\v\\n and related whitespace sequences) without triggering infinite loops. While v4.0.5 lacks the proactive loop-progress tracking added in the v18.0.2 patch, its tokenizer implementation successfully advances on all tested inputs, preventing unbounded memory consumption. This is Rule 5 Type A2: input is received but no path reaches the goal." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.5.", "vulnerability": { "name": "GHSA-32vw-r77c-gm67" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.5.", "vulnerability": { "name": "GHSA-7m7q-q53v-j47v" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.5.", "vulnerability": { "name": "GHSA-8wp3-cp9v-44fm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:38:00.054058+00:00", "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 4.0.5 of marked. not_affected \u2014 The target is NOT AFFECTED by GHSA-ch52-vgq2-943f. The ReDoS vulnerability in the `_label` regex was fixed in upstream version 0.7.0 (commit ded5e24f, July 2019) by changing the vulnerable pattern `\\\\[\\[\\]]?` to `\\\\.`, eliminating catastrophic backtracking. This fix was authored by upstream developer Tony Brix and was already present in the upstream release that TuxCare onboarded for version 4....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-ch52-vgq2-943f" }, "impact_statement": "not_affected \u2014 The target is NOT AFFECTED by GHSA-ch52-vgq2-943f. The ReDoS vulnerability in the `_label` regex was fixed in upstream version 0.7.0 (commit ded5e24f, July 2019) by changing the vulnerable pattern `\\\\[\\[\\]]?` to `\\\\.`, eliminating catastrophic backtracking. This fix was authored by upstream developer Tony Brix and was already present in the upstream release that TuxCare onboarded for version 4...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.5.", "vulnerability": { "name": "GHSA-wjmf-58vc-xqjr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.5", "identifiers": { "purl": "pkg:npm/marked@4.0.5" } } ], "timestamp": "2026-11-04T08:33:00.106702+00:00", "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 4.0.5 of marked. not_affected \u2014 Version 4.0.5 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS via quadratic-time email parsing). The vulnerability was fixed in upstream commit be27472a by Anders Kaseorg on 2019-04-03 and released in v0.6.2 (2019-04-05). The target version 4.0.5 was released upstream on 2021-11-25, well after the fix, and TuxCare onboarded it on 2026-08-05 with the fix already present. The defensive regex patter...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-xf5p-87ch-gxw2" }, "impact_statement": "not_affected \u2014 Version 4.0.5 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS via quadratic-time email parsing). The vulnerability was fixed in upstream commit be27472a by Anders Kaseorg on 2019-04-03 and released in v0.6.2 (2019-04-05). The target version 4.0.5 was released upstream on 2021-11-25, well after the fix, and TuxCare onboarded it on 2026-08-05 with the fix already present. The defensive regex patter..." } ] }