Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

published 2026-06-19 4 mo ago modified 2026-09-30 39 d ago also GHSA-gx93-m64w-5m6h , EUVD-2026-77688

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.

Patch / fix

fixed in 1 links 3

maven io.qameta.allure:allure-generator 2.39.0

github.com/allure-framework/allure2@1c56939 commit
github.com/allure-framework/allure2#3296 pull request
github.com/allure-framework/allure2/releases/tag/2.39.0 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 55 d ago (2026-09-14)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	io.qameta.allure:allure-generator	<2.39.0	2.39.0

Affected products

allure-framework allure2
io.qameta.allure allure-generator

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary