{"id":"CVE-2026-55847","summary":"Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering","details":"Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.","aliases":["GHSA-gx93-m64w-5m6h"],"modified":"2026-09-16T08:11:42.331707Z","published":"2026-09-14T17:22:11.359Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55847.json"},"references":[{"type":"WEB","url":"https://github.com/allure-framework/allure2/releases/tag/2.39.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55847.json"},{"type":"ADVISORY","url":"https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55847"},{"type":"FIX","url":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd"},{"type":"FIX","url":"https://github.com/allure-framework/allure2/pull/3296"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/allure-framework/allure2","events":[{"introduced":"0"},{"fixed":"1c5693933f519e64379f1a14eb3c7beeba7bc7cd"},{"fixed":"224d3dd5d6f6df30e8f9cbace62696d2c24d688f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.39.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.38.1","2.38.0","2.37.0","2.36.0","2.35.1","2.35.0","2.34.1","2.34.0","2.33.0","2.32.2","2.32.1","2.32.0","2.31.0","2.30.0","2.29.0","2.28.0","2.27.0","2.26.0","2.25.0","2.24.1","2.24.0","2.23.1","2.23.0","2.22.4","2.22.3","2.22.2","2.22.1","2.22.0","2.21.0","2.20.1","2.20.0","2.19.0","2.18.1","2.18.0","2.17.3","2.17.2","2.17.1","2.17.0","2.16.1","2.16.0","2.15.0","2.14.0","2.13.10","2.13.9","2.13.8","2.13.7","2.13.6","2.13.5","2.13.4","2.13.3","2.13.2","2.13.1","2.13.0","2.12.1","2.12.0","2.11.0","2.10.0","2.9.0","2.8.1","2.8.0","2.7.0","2.6.0","2.5.0","2.4.1","2.4.0","2.3.5","2.3.4","2.3.3","2.3.2","2.3.1","2.3","2.2.1","2.2.0","2.1.1","2.1.0","2.0.1","2.0.0","2.0-BETA8","2.0-BETA7","2.0-BETA6","2.0-BETA5","2.0-BETA4","2.0-BETA3","2.0-BETA1","2.0-M1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55847.json","vanir_signatures_modified":"2026-09-16T08:11:42Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/test/java/io/qameta/allure/category/CategoriesPluginTest.java"},"deprecated":false,"digest":{"line_hashes":["164115113833195878605718560645200923589","236808581582434323811328504488865048553","253563744498994906166297438595429637971","227728833836097553471102636505145488015","194556723267809436901538906352814835741","60970823427784967943410216988303571417","278338270219846018202975163879686022310","141144789634227975812171847811104239118"],"threshold":0.9},"id":"CVE-2026-55847-09de1a2b","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/category/CategoriesPlugin.java"},"deprecated":false,"digest":{"line_hashes":["285459869523392775136503668059868421909","74850335478855261361574745034667386411","130201538919399049413015082041479136053","19368722694557870374717986649072849541","116459958373384609789513513503724444636","168156004103218995636478586258291373712","142542362734892716974692047713093048001","47612815783932785444114820263230274777"],"threshold":0.9},"id":"CVE-2026-55847-11463fdb","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/test/java/io/qameta/allure/allure2/Allure2PluginTest.java"},"deprecated":false,"digest":{"line_hashes":["241210944552558531563526628397234718422","219580964178765273715271148067763794466","175307492224977463083968315576111807891"],"threshold":0.9},"id":"CVE-2026-55847-144750cf","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/category/CategoriesPlugin.java","function":"readResults"},"deprecated":false,"digest":{"function_hash":"3790290213821273761805122225097081319","length":491},"id":"CVE-2026-55847-3faaff57","signature_type":"Function"},{"source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/allure1/Allure1Plugin.java"},"deprecated":false,"digest":{"line_hashes":["60883449274262812147819999078535316930","94677989632604075294919441495831054376","203490631379613091738499971065452484776","324688223611233628107988215004195710797","300980071057100047023531572610277350096","3307096043996022276181603395077952460","6807080718866362769469909429315388788","86937419353926709854892346420965092214"],"threshold":0.9},"id":"CVE-2026-55847-51f2a4c6","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"70546763740075469099732377519328624110","length":685},"id":"CVE-2026-55847-68933e97","signature_type":"Function","signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/allure2/Allure2Plugin.java","function":"getTestStage"}},{"deprecated":false,"digest":{"function_hash":"203275256957059462519299476082341778110","length":871},"id":"CVE-2026-55847-78cc98fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/allure2/Allure2Plugin.java","function":"convert"}},{"deprecated":false,"digest":{"line_hashes":["60551415276631098533815297610479538392","83186761732682352589320255613588853221","5870288768284359396777740322596133474"],"threshold":0.9},"id":"CVE-2026-55847-b791438b","signature_type":"Line","signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/test/java/io/qameta/allure/allure1/Allure1PluginTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/allure1/Allure1Plugin.java","function":"getDescriptionHtml"},"deprecated":false,"digest":{"function_hash":"62242621741391615457745905206055544556","length":225},"id":"CVE-2026-55847-d3fa8d5b"},{"signature_version":"v1","source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/allure2/Allure2Plugin.java","function":"convert"},"deprecated":false,"digest":{"function_hash":"87986467399125809782419870433868120506","length":1494},"id":"CVE-2026-55847-e56c0180","signature_type":"Function"},{"source":"https://github.com/allure-framework/allure2/commit/1c5693933f519e64379f1a14eb3c7beeba7bc7cd","target":{"file":"allure-generator/src/main/java/io/qameta/allure/allure2/Allure2Plugin.java"},"deprecated":false,"digest":{"line_hashes":["279784319809601335477949458075482204122","193726468982003733773826688154286931143","38109736525506403667803860038663272819","90098918570003507843435407695168158129","149988046619593398835298567485333151067","57507052053662961761641451215209644926","156232949253455084215815192603707292533","338762480386574487404736533175613580095","16465014490079568101141260927144368117","36659172366245968302682169014439649285","317555416048100701322394809374377795968","318358392505428137974794491287874365142","328871130538548151866801864451057016807","323086549262266986237952772910943212146","26056142751383522338255772680345357117","70280790483645435551781969059298923943","65075074383220348913944094686414986424","70766102907853225889158705823920248815","178826113179697825152382617863933380332"],"threshold":0.9},"id":"CVE-2026-55847-eb2bf4f0","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}