{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:90857f09-64a4-5554-9823-8a209d488b31",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/marked@0.3.19-tuxcare.1",
      "type": "library",
      "name": "marked",
      "version": "0.3.19-tuxcare.1",
      "purl": "pkg:npm/marked@0.3.19-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:48217c3b-e6c3-5370-ae77-da760676f57f",
      "id": "CVE-2020-7693",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-7693 is fixed in version 0.3.19-tuxcare.1 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@0.3.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a3f90da-f91e-5358-8f2e-a15ee6a36a96",
      "id": "CVE-2022-21680",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-21680 is fixed in version 0.3.19-tuxcare.1 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@0.3.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f69cde1e-60be-5c35-967a-d19e3af1f370",
      "id": "CVE-2022-21681",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-21681 is fixed in version 0.3.19-tuxcare.1 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@0.3.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d644065b-f7f1-59cb-9599-f401319f767b",
      "id": "CVE-2026-41680",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41680 does not affect version 0.3.19-tuxcare.1 of marked. Target version 0.3.19-tuxcare.1 is not affected by CVE-2026-41680. The vulnerability affects marked versions 18.0.0-18.0.1 where specific whitespace input triggers an infinite loop. Empirical testing confirms version 0.3.19 successfully parses the CVE's trigger input (\\t\\v\\n) without entering an infinite loop. The architecture differs fundamentally from version 18.x - the parsing logic in 0.3.19 successfully consumes the problematic input, preventing the unbounded loop iteration that characterizes the vulnerability."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@0.3.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f96ce32a-6747-5e27-9349-fc3532134cc4",
      "id": "GHSA-xf5p-87ch-gxw2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-xf5p-87ch-gxw2 is fixed in version 0.3.19-tuxcare.1 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@0.3.19-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/marked@0.3.19-tuxcare.1"
    }
  ]
}