CVE-2026-55847mediumCWE-79

CVE-2026-55847: fallo de gravedad media en io.qameta.allure allure-generator

Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

Publicada el

Seguir esta CVE+ Monitorear allure2+ Monitorear allure-generator

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.3%
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
allure-framework · allure2io.qameta.allure · allure-generator
CVEs relacionadas — io.qameta.allure allure-generator

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-33166HIGHAllure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)EPSS 0.6%CVE-2025-52888HIGHAllure 2's xunit-xml-plugin Vulnerable to Improper XXE RestrictionEPSS 0.4%CVE-2026-55846MEDIUMAllure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File ReadEPSS 0.2%