Vulnerability-Lookup

CVE-2026-55847 (GCVE-0-2026-55847)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:22 – Updated: 2026-09-14 20:06

Title

Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

Summary

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 19:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/allure-framework/allure2/secur…	x_refsource_CONFIRM
https://github.com/allure-framework/allure2/pull/3296	x_refsource_MISC
https://github.com/allure-framework/allure2/commi…	x_refsource_MISC
https://github.com/allure-framework/allure2/relea…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
allure-framework	allure2	Affected: < 2.39.0	guessed
io.qameta.allure	allure-generator	Affected: < 2.39.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55847",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:20:49.067025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:06:08.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "allure2",
          "vendor": "allure-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.39.0"
            }
          ]
        },
        {
          "product": "allure-generator",
          "vendor": "io.qameta.allure",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.39.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:22:11.359Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h"
        },
        {
          "name": "https://github.com/allure-framework/allure2/pull/3296",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/allure-framework/allure2/pull/3296"
        },
        {
          "name": "https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd"
        },
        {
          "name": "https://github.com/allure-framework/allure2/releases/tag/2.39.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/allure-framework/allure2/releases/tag/2.39.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gx93-m64w-5m6h",
        "discovery": "UNKNOWN"
      },
      "title": "Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55847",
    "datePublished": "2026-09-14T17:22:11.359Z",
    "dateReserved": "2026-06-17T16:29:38.865Z",
    "dateUpdated": "2026-09-14T20:06:08.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55847",
      "date": "2026-09-27",
      "epss": "0.00338",
      "percentile": "0.24649"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "allure2",
                "vendor": "allure-framework",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.39.0"
                  }
                ]
              },
              {
                "product": "allure-generator",
                "vendor": "io.qameta.allure",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.39.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0."
          }
        ],
        "id": "CVE-2026-55847",
        "lastModified": "2026-09-14T20:16:48.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55847",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:20:49.067025Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-14T18:17:55.990",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/allure-framework/allure2/pull/3296"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/allure-framework/allure2/releases/tag/2.39.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55847",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-14T19:20:49.067025Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-14T19:20:50.390Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "allure2",
              "vendor": "allure-framework",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.39.0"
                }
              ]
            },
            {
              "product": "allure-generator",
              "vendor": "io.qameta.allure",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.39.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-14T17:22:11.359Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h"
            },
            {
              "name": "https://github.com/allure-framework/allure2/pull/3296",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/allure-framework/allure2/pull/3296"
            },
            {
              "name": "https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd"
            },
            {
              "name": "https://github.com/allure-framework/allure2/releases/tag/2.39.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/allure-framework/allure2/releases/tag/2.39.0"
            }
          ],
          "source": {
            "advisory": "GHSA-gx93-m64w-5m6h",
            "discovery": "UNKNOWN"
          },
          "title": "Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55847",
        "datePublished": "2026-09-14T17:22:11.359Z",
        "dateReserved": "2026-06-17T16:29:38.865Z",
        "dateUpdated": "2026-09-14T20:06:08.065Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55847

Vulnerability from fkie_nvd - Published: 2026-09-14 18:17 - Updated: 2026-09-14 20:16

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd
	security-advisories@github.com	https://github.com/allure-framework/allure2/pull/3296
	security-advisories@github.com	https://github.com/allure-framework/allure2/releases/tag/2.39.0
	security-advisories@github.com	https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "allure2",
          "vendor": "allure-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.39.0"
            }
          ]
        },
        {
          "product": "allure-generator",
          "vendor": "io.qameta.allure",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.39.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0."
    }
  ],
  "id": "CVE-2026-55847",
  "lastModified": "2026-09-14T20:16:48.180",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55847",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T19:20:49.067025Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T18:17:55.990",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/allure-framework/allure2/pull/3296"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/allure-framework/allure2/releases/tag/2.39.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GX93-M64W-5M6H

Vulnerability from github – Published: 2026-06-19 21:15 – Updated: 2026-06-19 21:15

Summary

Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering

Details

Summary

The ansi.js Handlebars helper in allure-generator passes user-controlled statusMessage and statusTrace values from test result files through the ansi-to-html library and wraps the output in Handlebars SafeString without HTML escaping. Since ansi-to-html does not escape HTML entities by default, an attacker who can influence test result content (e.g., via crafted JUnit XML failure messages) can inject arbitrary JavaScript that executes when anyone views the generated Allure report.

Details

The vulnerability is an incomplete fix — commit 4c64b19 (PR #3271) fixed XSS in linky.js and text-with-links.js by adding escapeExpression(), but the same pattern in ansi.js was not addressed.

Vulnerable sink — allure-generator/src/main/javascript/helpers/ansi.js:10-11:

export default function (input) {
    return new SafeString(ansiConverter.toHtml(input));
};

The AnsiToHtml constructor at line 4 does not set escapeForHtml: true:

const ansiConverter = new AnsiToHtml({
    fg: "black",
    bg: "black",
    newline: true,
});

The ansi-to-html library (v0.7.2) defaults escapeForHtml to false, meaning HTML entities in the input pass through unchanged. Wrapping the result in SafeString tells Handlebars to skip its auto-escaping, so the raw HTML reaches the browser.

Template usage — allure-generator/src/main/javascript/blocks/status-details/status-details.hbs:7,10:

<pre class="status-details__message"><code>{{ansi statusMessage}}</code></pre>
...
<pre class="{{b 'status-details' 'trace'}}"><code>{{ansi statusTrace}}</code></pre>

Source — plugins/junit-xml-plugin/src/main/java/io/qameta/allure/junitxml/JunitXmlPlugin.java:307-308:

result.setStatusMessage(element.getAttribute(MESSAGE_ATTRIBUTE_NAME));
result.setStatusTrace(element.getValue());

These values are read directly from XML attributes with no sanitization. The same pattern exists in TRX, xUnit XML, xctest, and Allure1/2 plugins.

Contrast with the fixed helper — linky.js (post-fix) correctly escapes before wrapping in SafeString:

const safeText = escapeExpression(text);
return new SafeString(`<a href="${safeText}" ...>${safeText}</a>`);

PoC

Create a malicious JUnit XML test result file:

<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="XSSTest" tests="1" failures="1">
  <testcase name="xssPayload" classname="com.example.Test">
    <failure message="&lt;img src=x onerror=alert(document.cookie)&gt;">
      Stack trace: &lt;img src=x onerror=alert('statusTrace_XSS')&gt;
    </failure>
  </testcase>
</testsuite>

Generate an Allure report:

allure generate /path/to/results-with-malicious-xml -o /tmp/allure-report

Open the report and navigate to the failed test case:

allure open /tmp/allure-report

When viewing the test's status details, the <img onerror> payloads execute JavaScript in the viewer's browser.

Impact

Arbitrary JavaScript execution in the browser of anyone viewing the generated Allure report
Cookie theft, session hijacking if the report is served from a domain with active sessions (e.g., CI dashboards)
Data exfiltration — the injected script can read the full report content and send it to an attacker-controlled server
Attack vectors: A malicious dependency that throws crafted exception messages, a CI pipeline processing test results from untrusted pull requests, or a contributor submitting test files containing XSS payloads
Allure reports are commonly hosted on CI/CD platforms (Jenkins, GitLab, GitHub Actions artifacts) where session cookies may be present

Recommended Fix

Configure AnsiToHtml with escapeForHtml: true to escape HTML entities while preserving ANSI-to-HTML conversion:

import AnsiToHtml from "ansi-to-html";
import {SafeString} from "handlebars/runtime";

const ansiConverter = new AnsiToHtml({
    fg: "black",
    bg: "black",
    newline: true,
    escapeForHtml: true,  // Escape HTML entities in non-ANSI input
});

export default function (input) {
    return new SafeString(ansiConverter.toHtml(input));
};

This is the correct approach because it preserves the ANSI escape sequence → HTML conversion (colored output) while ensuring that any non-ANSI HTML in the input is safely escaped. The alternative of using escapeExpression() on the input would destroy ANSI sequences before they could be converted.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.38.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.qameta.allure:allure-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.39.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55847"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T21:15:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `ansi.js` Handlebars helper in allure-generator passes user-controlled `statusMessage` and `statusTrace` values from test result files through the `ansi-to-html` library and wraps the output in Handlebars `SafeString` without HTML escaping. Since `ansi-to-html` does not escape HTML entities by default, an attacker who can influence test result content (e.g., via crafted JUnit XML failure messages) can inject arbitrary JavaScript that executes when anyone views the generated Allure report.\n\n## Details\n\nThe vulnerability is an incomplete fix \u2014 commit `4c64b19` (PR #3271) fixed XSS in `linky.js` and `text-with-links.js` by adding `escapeExpression()`, but the same pattern in `ansi.js` was not addressed.\n\n**Vulnerable sink** \u2014 `allure-generator/src/main/javascript/helpers/ansi.js:10-11`:\n```javascript\nexport default function (input) {\n    return new SafeString(ansiConverter.toHtml(input));\n};\n```\n\nThe `AnsiToHtml` constructor at line 4 does not set `escapeForHtml: true`:\n```javascript\nconst ansiConverter = new AnsiToHtml({\n    fg: \"black\",\n    bg: \"black\",\n    newline: true,\n});\n```\n\nThe `ansi-to-html` library (v0.7.2) defaults `escapeForHtml` to `false`, meaning HTML entities in the input pass through unchanged. Wrapping the result in `SafeString` tells Handlebars to skip its auto-escaping, so the raw HTML reaches the browser.\n\n**Template usage** \u2014 `allure-generator/src/main/javascript/blocks/status-details/status-details.hbs:7,10`:\n```handlebars\n\u003cpre class=\"status-details__message\"\u003e\u003ccode\u003e{{ansi statusMessage}}\u003c/code\u003e\u003c/pre\u003e\n...\n\u003cpre class=\"{{b \u0027status-details\u0027 \u0027trace\u0027}}\"\u003e\u003ccode\u003e{{ansi statusTrace}}\u003c/code\u003e\u003c/pre\u003e\n```\n\n**Source** \u2014 `plugins/junit-xml-plugin/src/main/java/io/qameta/allure/junitxml/JunitXmlPlugin.java:307-308`:\n```java\nresult.setStatusMessage(element.getAttribute(MESSAGE_ATTRIBUTE_NAME));\nresult.setStatusTrace(element.getValue());\n```\n\nThese values are read directly from XML attributes with no sanitization. The same pattern exists in TRX, xUnit XML, xctest, and Allure1/2 plugins.\n\n**Contrast with the fixed helper** \u2014 `linky.js` (post-fix) correctly escapes before wrapping in `SafeString`:\n```javascript\nconst safeText = escapeExpression(text);\nreturn new SafeString(`\u003ca href=\"${safeText}\" ...\u003e${safeText}\u003c/a\u003e`);\n```\n\n## PoC\n\n1. Create a malicious JUnit XML test result file:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003ctestsuite name=\"XSSTest\" tests=\"1\" failures=\"1\"\u003e\n  \u003ctestcase name=\"xssPayload\" classname=\"com.example.Test\"\u003e\n    \u003cfailure message=\"\u0026lt;img src=x onerror=alert(document.cookie)\u0026gt;\"\u003e\n      Stack trace: \u0026lt;img src=x onerror=alert(\u0027statusTrace_XSS\u0027)\u0026gt;\n    \u003c/failure\u003e\n  \u003c/testcase\u003e\n\u003c/testsuite\u003e\n```\n\n2. Generate an Allure report:\n\n```bash\nallure generate /path/to/results-with-malicious-xml -o /tmp/allure-report\n```\n\n3. Open the report and navigate to the failed test case:\n\n```bash\nallure open /tmp/allure-report\n```\n\n4. When viewing the test\u0027s status details, the `\u003cimg onerror\u003e` payloads execute JavaScript in the viewer\u0027s browser.\n\n## Impact\n\n- **Arbitrary JavaScript execution** in the browser of anyone viewing the generated Allure report\n- **Cookie theft, session hijacking** if the report is served from a domain with active sessions (e.g., CI dashboards)\n- **Data exfiltration** \u2014 the injected script can read the full report content and send it to an attacker-controlled server\n- **Attack vectors**: A malicious dependency that throws crafted exception messages, a CI pipeline processing test results from untrusted pull requests, or a contributor submitting test files containing XSS payloads\n- Allure reports are commonly hosted on CI/CD platforms (Jenkins, GitLab, GitHub Actions artifacts) where session cookies may be present\n\n## Recommended Fix\n\nConfigure `AnsiToHtml` with `escapeForHtml: true` to escape HTML entities while preserving ANSI-to-HTML conversion:\n\n```javascript\nimport AnsiToHtml from \"ansi-to-html\";\nimport {SafeString} from \"handlebars/runtime\";\n\nconst ansiConverter = new AnsiToHtml({\n    fg: \"black\",\n    bg: \"black\",\n    newline: true,\n    escapeForHtml: true,  // Escape HTML entities in non-ANSI input\n});\n\nexport default function (input) {\n    return new SafeString(ansiConverter.toHtml(input));\n};\n```\n\nThis is the correct approach because it preserves the ANSI escape sequence \u2192 HTML conversion (colored output) while ensuring that any non-ANSI HTML in the input is safely escaped. The alternative of using `escapeExpression()` on the input would destroy ANSI sequences before they could be converted.",
  "id": "GHSA-gx93-m64w-5m6h",
  "modified": "2026-06-19T21:15:53Z",
  "published": "2026-06-19T21:15:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/allure-framework/allure2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering"
}

UBUNTU-CVE-2026-55847 (CVE-2026-55847)

Vulnerability from osv_ubuntu – Published: 2026-09-14 18:17 – Updated: 2026-09-16 11:36 – Source website

Details

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-55847	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-55847	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "allure",
            "binary_version": "0.5.0.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "allure",
        "purl": "pkg:deb/ubuntu/allure@0.5.0.0-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.5.0.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "allure",
            "binary_version": "0.8.3.0-3build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "allure",
        "purl": "pkg:deb/ubuntu/allure@0.8.3.0-3build3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.3.0-3build1",
        "0.8.3.0-3build2",
        "0.8.3.0-3build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "allure",
            "binary_version": "0.9.5.0-2build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "allure",
        "purl": "pkg:deb/ubuntu/allure@0.9.5.0-2build1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.5.0-2build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "allure",
            "binary_version": "0.11.0.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "allure",
        "purl": "pkg:deb/ubuntu/allure@0.11.0.0-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.11.0.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "allure",
            "binary_version": "0.11.0.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "allure",
        "purl": "pkg:deb/ubuntu/allure@0.11.0.0-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.11.0.0-1",
        "0.11.0.0-1build1",
        "0.11.0.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.",
  "id": "UBUNTU-CVE-2026-55847",
  "modified": "2026-09-16T11:36:39Z",
  "published": "2026-09-14T18:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-55847"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55847"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-55847"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55847 (GCVE-0-2026-55847)

FKIE_CVE-2026-55847

GHSA-GX93-M64W-5M6H

Summary

Details

PoC

Impact

Recommended Fix

UBUNTU-CVE-2026-55847 (CVE-2026-55847)

Tags

Sightings

Nomenclature

Related by attack behaviour