{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4f25e41e-7f7a-5496-9597-ac96a360d75c",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/marked@4.0.5",
      "type": "library",
      "name": "marked",
      "version": "4.0.5",
      "purl": "pkg:npm/marked@4.0.5"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:d83afd31-4271-5557-befb-3bde343d7bd1",
      "id": "CVE-2022-21680",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-21680 affects version 4.0.5 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@4.0.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:305e14c2-83a2-5517-879d-600144a4041e",
      "id": "CVE-2022-21681",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-21681 affects version 4.0.5 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@4.0.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e2c7c0ee-0904-5a94-9c22-1f7a017e30a6",
      "id": "CVE-2026-41680",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41680 does not affect version 4.0.5 of marked. CVE-2026-41680 does NOT affect marked v4.0.5. The vulnerability was introduced in v18.0.0 (5 years and 1,372 commits later) by changes to the tokenizer implementation. Empirical testing confirms v4.0.5 successfully parses all variations of the CVE input (\\t\\v\\n and related whitespace sequences) without triggering infinite loops. While v4.0.5 lacks the proactive loop-progress tracking added in the v18.0.2 patch, its tokenizer implementation successfully advances on all tested inputs, preventing unbounded memory consumption. This is Rule 5 Type A2: input is received but no path reaches the goal."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@4.0.5"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/marked@4.0.5"
    }
  ]
}