{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:839e376d-0695-506a-80fb-81cec691d34b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/marked@4.0.9-tuxcare.3",
      "type": "library",
      "name": "marked",
      "version": "4.0.9-tuxcare.3",
      "purl": "pkg:npm/marked@4.0.9-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:6b321666-54d8-5ea0-bab4-f1eac0d889ad",
      "id": "CVE-2022-21680",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-21680 is fixed in version 4.0.9-tuxcare.3 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@4.0.9-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e4e90861-3c5d-5d12-aeb6-8cfdc37912ec",
      "id": "CVE-2022-21681",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-21681 is fixed in version 4.0.9-tuxcare.3 of marked."
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@4.0.9-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b29c0ff0-d888-54b4-a678-4b63485a2d09",
      "id": "CVE-2026-41680",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41680 does not affect version 4.0.9-tuxcare.3 of marked. Version 4.0.9 is not vulnerable. Summary: The target repository (marked v4.0.9-tuxcare.3) is NOT vulnerable to CVE-2026-41680. The vulnerability requires the absence of tab preprocessing, which was introduced in v4.0.14. The target version predates this change and always converts tabs to spaces during preprocessing, preventing the infinite loop condition. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/marked@4.0.9-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/marked@4.0.9-tuxcare.3"
    }
  ]
}