{
  "@id": "urn:uuid:ad5b39fe-2701-474e-8b0e-969e4663aebe",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-09-24T09:31:26.931840+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2014-3743 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2014-3743"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-1370 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2015-1370"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-8854 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2015-8854"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-10531 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2016-10531"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-1000427 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2017-1000427"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-16114 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2017-16114"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-25110 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2018-25110"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21680 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2022-21680"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21681 is fixed in version 0.2.10-tuxcare.1 of marked.",
      "vulnerability": {
        "name": "CVE-2022-21681"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/marked@0.2.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/marked@0.2.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41680 does not affect version 0.2.10-tuxcare.1 of marked. Version 0.2.10 is not affected by CVE-2026-41680. The vulnerability exists only in versions 18.0.0-18.0.1 due to specific TypeScript Lexer implementation details. Version 0.2.10 uses a completely different JavaScript-based architecture where the code block parsing regex successfully matches and consumes the problematic input '\\t\\v\\n', preventing any infinite loop. Testing confirms the regex /^( {4}[^\\n]+\\n*)+/ consumes the entire preprocessed input '    \\v\\n' (6 characters), and the loop exits normally. The vulnerable code path from version 18.x is not present in this old version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41680"
      },
      "impact_statement": "Version 0.2.10 is not affected by CVE-2026-41680. The vulnerability exists only in versions 18.0.0-18.0.1 due to specific TypeScript Lexer implementation details. Version 0.2.10 uses a completely different JavaScript-based architecture where the code block parsing regex successfully matches and consumes the problematic input '\\t\\v\\n', preventing any infinite loop. Testing confirms the regex /^( {4}[^\\n]+\\n*)+/ consumes the entire preprocessed input '    \\v\\n' (6 characters), and the loop exits normally. The vulnerable code path from version 18.x is not present in this old version."
    }
  ]
}