Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-55847Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

Medium 6.1

In plain English

A medium-severity cross-site scripting in allure2 from allure-framework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.qameta.allure:allure-generator	2.39.0	GHSA-gx93-m64w-5m6h
Ubuntu:22.04:LTS	allure	no fix listed	UBUNTU-CVE-2026-55847
Ubuntu:24.04:LTS	allure	no fix listed	UBUNTU-CVE-2026-55847
Ubuntu:26.04:LTS	allure	no fix listed	UBUNTU-CVE-2026-55847
Ubuntu:26.10	allure	no fix listed	UBUNTU-CVE-2026-55847

Affected products (as reported)

Vendor	Product	Versions
allure-framework	allure2	< 2.39.0
io.qameta.allure	allure-generator	< 2.39.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h x_refsource_CONFIRM
https://github.com/allure-framework/allure2/pull/3296 x_refsource_MISC
https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd x_refsource_MISC
https://github.com/allure-framework/allure2/releases/tag/2.39.0 x_refsource_MISC