{ "@id": "urn:uuid:04187fbc-57cd-40d0-a47e-c89a060df8ac", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:44:00.034778+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:35:03.436701+00:00", "status_notes": "Vulnerability CVE-2014-3743 does not affect version 4.0.8 of marked. not_affected \u2014 Target version 4.0.8 is not affected by CVE-2014-3743. The vulnerability affects marked versions 0.3.0 and earlier, where JavaScript URLs obfuscated via HTML entities (e.g., `:`) could bypass the sanitize:true flag. The upstream fix (commit 904c71b7 by Christopher Jeffrey) added HTML entity decoding via unescape() before checking for javascript: protocols. This fix was released in marked ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3743" }, "impact_statement": "not_affected \u2014 Target version 4.0.8 is not affected by CVE-2014-3743. The vulnerability affects marked versions 0.3.0 and earlier, where JavaScript URLs obfuscated via HTML entities (e.g., `:`) could bypass the sanitize:true flag. The upstream fix (commit 904c71b7 by Christopher Jeffrey) added HTML entity decoding via unescape() before checking for javascript: protocols. This fix was released in marked ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:21:00.079636+00:00", "status_notes": "Vulnerability CVE-2015-1370 does not affect version 4.0.8 of marked. not_affected \u2014 The target repository (marked version 4.0.8-tuxcare.3) is NOT affected by CVE-2015-1370. The vulnerability, which allowed XSS through vbscript: protocol links even with sanitize:true enabled, was fixed by the upstream vendor in version 0.3.3 (January 2015). The fix is present in the current codebase at src/helpers.js:76 where the cleanUrl function explicitly checks for and rejects vbscript: pro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-1370" }, "impact_statement": "not_affected \u2014 The target repository (marked version 4.0.8-tuxcare.3) is NOT affected by CVE-2015-1370. The vulnerability, which allowed XSS through vbscript: protocol links even with sanitize:true enabled, was fixed by the upstream vendor in version 0.3.3 (January 2015). The fix is present in the current codebase at src/helpers.js:76 where the cleanUrl function explicitly checks for and rejects vbscript: pro..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:05:00.223594+00:00", "status_notes": "Vulnerability CVE-2015-8854 affects version 4.0.8 of marked.", "vulnerability": { "name": "CVE-2015-8854" }, "action_statement": "Vulnerability CVE-2015-8854 affects version 4.0.8 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:30:24.356556+00:00", "status_notes": "Vulnerability CVE-2016-10531 does not affect version 4.0.8 of marked. not_affected \u2014 CVE-2016-10531 affects marked versions prior to 0.3.6 due to an overly permissive HTML entity regex pattern in the unescape() function. The vulnerable regex /&([#\\w]+);/g would match malformed entity-like strings (e.g., :document), allowing javascript: URIs to bypass sanitization. The target version 4.0.8-tuxcare.3 contains the upstream fix (commit 31c77995) that restricts the regex to only ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10531" }, "impact_statement": "not_affected \u2014 CVE-2016-10531 affects marked versions prior to 0.3.6 due to an overly permissive HTML entity regex pattern in the unescape() function. The vulnerable regex /&([#\\w]+);/g would match malformed entity-like strings (e.g., :document), allowing javascript: URIs to bypass sanitization. The target version 4.0.8-tuxcare.3 contains the upstream fix (commit 31c77995) that restricts the regex to only ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:26:00.080994+00:00", "status_notes": "Vulnerability CVE-2017-1000427 does not affect version 4.0.8 of marked. not_affected \u2014 CVE-2017-1000427 affects marked \u22640.3.6 where the built-in sanitize feature failed to block data: URIs. The target version (4.0.8-tuxcare.3) contains the upstream fix from commit cd2f6f5b (2017-01-19) by Matt Austin, which added data: URI blocking to the sanitize logic. This fix shipped in the upstream release before TuxCare's onboarding commit 4e7ba143. The vulnerable code pattern (missing data...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-1000427" }, "impact_statement": "not_affected \u2014 CVE-2017-1000427 affects marked \u22640.3.6 where the built-in sanitize feature failed to block data: URIs. The target version (4.0.8-tuxcare.3) contains the upstream fix from commit cd2f6f5b (2017-01-19) by Matt Austin, which added data: URI blocking to the sanitize logic. This fix shipped in the upstream release before TuxCare's onboarding commit 4e7ba143. The vulnerable code pattern (missing data..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-16114 affects version 4.0.8 of marked.", "vulnerability": { "name": "CVE-2017-16114" }, "action_statement": "Vulnerability CVE-2017-16114 affects version 4.0.8 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability CVE-2017-17461 is a false positive for marked 4.0.8.", "vulnerability": { "name": "CVE-2017-17461" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:44:00.034778+00:00", "status_notes": "Vulnerability CVE-2018-25110 does not affect version 4.0.8 of marked. not_affected \u2014 CVE-2018-25110 affects marked versions prior to 0.3.17 due to ReDoS vulnerabilities in four regex patterns. The target version 4.0.8-tuxcare.3 already contains the upstream fix commit b15e42b6 from February 2018, which was shipped in the upstream release before TuxCare onboarding. The vulnerable regex patterns have been eliminated in both the fix commit and the current refactored codebase struc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-25110" }, "impact_statement": "not_affected \u2014 CVE-2018-25110 affects marked versions prior to 0.3.17 due to ReDoS vulnerabilities in four regex patterns. The target version 4.0.8-tuxcare.3 already contains the upstream fix commit b15e42b6 from February 2018, which was shipped in the upstream release before TuxCare onboarding. The vulnerable regex patterns have been eliminated in both the fix commit and the current refactored codebase struc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:38:00.054058+00:00", "status_notes": "Vulnerability CVE-2021-21306 does not affect version 4.0.8 of marked. not_affected \u2014 Target version 4.0.8-tuxcare.3 is NOT AFFECTED by CVE-2021-21306. The ReDoS vulnerability in emphasis/strong parsing was fixed in upstream commit 7293251c (Feb 7, 2021) authored by Trevor Buckner, which shipped in the upstream release v2.0.0. This fix was already present in version 4.0.8 when TuxCare onboarded the repository. The vulnerable regex patterns with nested quantifiers have been compl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21306" }, "impact_statement": "not_affected \u2014 Target version 4.0.8-tuxcare.3 is NOT AFFECTED by CVE-2021-21306. The ReDoS vulnerability in emphasis/strong parsing was fixed in upstream commit 7293251c (Feb 7, 2021) authored by Trevor Buckner, which shipped in the upstream release v2.0.0. This fix was already present in version 4.0.8 when TuxCare onboarded the repository. The vulnerable regex patterns with nested quantifiers have been compl..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21680 affects version 4.0.8 of marked, and is fixed in 4.0.8-tuxcare.1.", "vulnerability": { "name": "CVE-2022-21680" }, "action_statement": "Vulnerability CVE-2022-21680 affects version 4.0.8 of marked, and is fixed in 4.0.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-10-09T22:30:03.094654+00:00", "status_notes": "Vulnerability CVE-2022-21681 affects version 4.0.8 of marked, and is fixed in 4.0.8-tuxcare.3.", "vulnerability": { "name": "CVE-2022-21681" }, "action_statement": "Vulnerability CVE-2022-21681 affects version 4.0.8 of marked, and is fixed in 4.0.8-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41680 affects version 4.0.8 of marked.", "vulnerability": { "name": "CVE-2026-41680" }, "action_statement": "Vulnerability CVE-2026-41680 affects version 4.0.8 of marked." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-32vw-r77c-gm67 is a false positive for marked 4.0.8.", "vulnerability": { "name": "GHSA-32vw-r77c-gm67" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-7m7q-q53v-j47v is a false positive for marked 4.0.8.", "vulnerability": { "name": "GHSA-7m7q-q53v-j47v" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-8wp3-cp9v-44fm is a false positive for marked 4.0.8.", "vulnerability": { "name": "GHSA-8wp3-cp9v-44fm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:36:59.454202+00:00", "status_notes": "Vulnerability GHSA-ch52-vgq2-943f does not affect version 4.0.8 of marked. not_affected \u2014 GHSA-ch52-vgq2-943f affects marked versions >= 0.4.0, < 0.7.0. The target is version 4.0.8-tuxcare.3, which is well above the first patched version (0.7.0). The vulnerability was a ReDoS issue in the _label regex using the pattern [^\\]]* that allowed catastrophic backtracking with nested brackets. The fix (commit b15e42b67cec9ded8505e9d68bb8741ad7a9590d by upstream author Jamie Davis) changed t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-ch52-vgq2-943f" }, "impact_statement": "not_affected \u2014 GHSA-ch52-vgq2-943f affects marked versions >= 0.4.0, < 0.7.0. The target is version 4.0.8-tuxcare.3, which is well above the first patched version (0.7.0). The vulnerability was a ReDoS issue in the _label regex using the pattern [^\\]]* that allowed catastrophic backtracking with nested brackets. The fix (commit b15e42b67cec9ded8505e9d68bb8741ad7a9590d by upstream author Jamie Davis) changed t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-02T18:06:00.161896+00:00", "status_notes": "Vulnerability GHSA-wjmf-58vc-xqjr is a false positive for marked 4.0.8.", "vulnerability": { "name": "GHSA-wjmf-58vc-xqjr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/marked@4.0.8", "identifiers": { "purl": "pkg:npm/marked@4.0.8" } } ], "timestamp": "2026-11-04T08:33:00.106702+00:00", "status_notes": "Vulnerability GHSA-xf5p-87ch-gxw2 does not affect version 4.0.8 of marked. not_affected \u2014 Target version 4.0.8 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS in email address parsing). The vulnerable regex patterns were fixed by the upstream marked project in commits b15e42b6 (Feb 2018, catastrophic backtracking in HTML/link regexes) and be27472a (Apr 2019, quadratic email scanning). Both fixes were included in the upstream 4.0.8 release (Dec 2021) that TuxCare onboarded. The vulnera...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-xf5p-87ch-gxw2" }, "impact_statement": "not_affected \u2014 Target version 4.0.8 is not affected by GHSA-xf5p-87ch-gxw2 (ReDoS in email address parsing). The vulnerable regex patterns were fixed by the upstream marked project in commits b15e42b6 (Feb 2018, catastrophic backtracking in HTML/link regexes) and be27472a (Apr 2019, quadratic email scanning). Both fixes were included in the upstream 4.0.8 release (Dec 2021) that TuxCare onboarded. The vulnera..." } ] }