{
  "@id": "urn:uuid:6092ed08-6222-49c9-b86b-ed18b371140b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-28T22:44:11.275398+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p3+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-46734"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "CVE-2026-30838"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "CVE-2026-33347"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "CVE-2026-71478"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "CVE-2026-71488"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-08T11:19:43.004255+00:00",
      "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.",
      "vulnerability": {
        "name": "GHSA-3q6v-r5mr-hxv8"
      },
      "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-8rr7-cvq3-gmfh"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-08T11:19:43.004255+00:00",
      "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.",
      "vulnerability": {
        "name": "GHSA-97jj-33gv-5xf9"
      },
      "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:17:59.746031+00:00",
      "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-c2pc-g5qf-rfrf"
      },
      "action_statement": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.7.1-p3+tuxcare of league/commonmark."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-f8fg-pg57-v4j8"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-g2gp-3wwq-f4ph"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-j8pm-gj4c-rq4x"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-jfm3-95jq-q3rf"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-jjv6-8j6v-6j52"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-mh25-x5hq-wrqp"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p3+tuxcare of league/commonmark.",
      "vulnerability": {
        "name": "GHSA-mj63-m3rc-8ppr"
      }
    }
  ]
}