Cross-site Scripting Vulnerability in Allure Report Prior to Version 2.39.0
CVE-2026-55847
6.1MEDIUM
What is CVE-2026-55847?
Allure Report versions prior to 2.39.0 contain a vulnerability that permits attackers to inject malicious JavaScript into reports. This occurs due to the unescaped handling of status messages and trace values by the ansi.js helper. By exploiting crafted JUnit XML failure messages, adversaries can execute arbitrary JavaScript in the report's context, potentially compromising session data and exposing sensitive information. This flaw represents an incomplete fix case, as earlier patches did not adequately address the ANSI helper, allowing abuse through various input flows associated with different test report formats.
Affected Version(s)
allure-generator < 2.39.0
allure2 < 2.39.0