CVE-2026-55847 in Allure
Summary
by MITRE • 09/14/2026
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
Allure Report serves as a widely adopted multi-language test reporting tool, facilitating the visualization of automated test results across various frameworks and programming languages. The vulnerability identified within versions prior to 2.39.0 resides specifically in the JavaScript helper module responsible for processing ANSI escape codes into HTML format. This component, located at allure-generator/src/main/javascript/helpers/ansi.js, is designed to convert terminal-style colored text output into styled HTML elements for display in web browsers. However, a critical implementation flaw exists wherein this function passes attacker-influenced input values, specifically the statusMessage and statusTrace fields, directly through an ANSI-to-HTML conversion process without applying necessary HTML entity encoding or sanitization prior to rendering.
The core technical deficiency lies in how the processed output is integrated into the Handlebars templating engine used by Allure Report. After converting the ANSI codes, the helper wraps the resulting string in a Handlebars SafeString object. This wrapper explicitly instructs the template engine that the content is already safe and should not undergo further automatic escaping or sanitization checks. Consequently, any malicious markup embedded within the input data bypasses standard security filters designed to prevent Cross-Site Scripting attacks. The vulnerability affects multiple plugin implementations including JunitXmlPlugin.java, TRX, xUnit XML, xctest, Allure1, and Allure2 plugins, as they all populate these specific fields from external test result files which may be crafted by an adversary or compromised build systems.
The operational impact of this flaw is significant for organizations relying on Allure Report to monitor continuous integration pipelines and quality assurance metrics. When a user with access to the report views the status details section containing maliciously crafted failure messages or traces, the unescaped HTML markup executes arbitrary JavaScript within the context of the report's origin. This constitutes a stored Cross-Site Scripting vulnerability because the payload is persisted in the test results file itself and executed upon viewing by any authorized user. The execution environment allows attackers to access sensitive data displayed on the page, such as internal build logs or proprietary code snippets visible in trace outputs, steal session cookies associated with the Allure Report instance, perform actions on behalf of the victim, or redirect users to phishing sites.
This incident is classified as an incomplete-fix case because a previous security patch attempted to address similar vulnerabilities by escaping link helpers but failed to extend those protections to the ANSI helper module. This oversight left a persistent attack vector open despite prior remediation efforts for other input vectors. The vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. From an offensive security perspective, this behavior maps to MITRE ATT&CK technique T1059.007, JavaScript Execution via Stored Payloads within web applications. The attack chain typically involves injecting malicious content into the test result XML files during a build process or through manual manipulation of artifacts before they are uploaded to the reporting server.
Mitigation strategies must prioritize immediate upgrading to version 2.39.0 or later where this specific flaw has been resolved by ensuring proper HTML escaping is applied even when using SafeString wrappers for dynamic content derived from external sources. For environments unable to upgrade immediately, administrators should implement strict input validation and sanitization at the ingestion layer of their CI/CD pipelines to strip or encode potentially dangerous characters in status messages and traces before they are written into XML artifacts. Additionally, deploying a Content Security Policy header with restrictive script-src directives can mitigate the impact by preventing the execution of inline scripts unless explicitly whitelisted, thereby reducing the effectiveness of any successful exploitation attempts until a permanent patch is applied.