Description

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-14T18:17:55.990Z",
  "pubdate": "2026-09-14T18:17:55.990Z",
  "executiveSummary": "Allure 2, prior to version 2.39.0, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from the improper sanitization of test status information processed by the ansi.js helper. Attackers can inject malicious markup into various report input formats, such as JUnit XML, TRX, or xUnit files, which the Allure generator subsequently processes.\nWhen a user renders the generated report, the application executes the injected JavaScript within the context of the report origin. This compromise allows for the unauthorized access of sensitive report data and the potential hijacking of user sessions associated with the origin. The vulnerability represents an incomplete remediation of previous security efforts targeting the template engine. Allure 2 reports are often shared in collaborative environments, making this XSS vector a significant risk for organizations relying on test automation reports for CI/CD pipeline visibility.",
  "technicalDetails": "The vulnerability is located within the ansi.js helper file (allure-generator/src/main/javascript/helpers/ansi.js) of the Allure 2 reporting framework. The root cause is the unsafe combination of raw input handling and the suppression of template auto-escaping mechanisms.\nSpecifically, the application takes user-influenced strings, namely 'statusMessage' and 'statusTrace', and processes them through an AnsiToHtml conversion function. This output is then encapsulated in a Handlebars SafeString object. By invoking SafeString, the generator explicitly instructs the Handlebars templating engine in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs to disable auto-escaping for the output. Because the AnsiToHtml helper does not perform HTML entity encoding on the input, any markup tags—including script tags or event handlers—contained within these fields are rendered directly into the Document Object Model (DOM).\nThe attack flow begins with the injection of a malicious payload into a test result source file, such as a JUnit XML file. Plugins such as JunitXmlPlugin.java, as well as those supporting TRX, xUnit XML, xctest, Allure1, and Allure2 formats, parse these files and populate the status fields. Once the Allure report is generated, the malicious payload is persisted in the output report. When a user navigates to the specific status detail view within the generated HTML report, the browser executes the injected JavaScript.\nThis execution occurs within the context of the report's origin, enabling an attacker to perform actions as the victim. This includes, but is not limited to, reading sensitive test configuration data, exfiltrating session tokens if the report is hosted on an authenticated internal dashboard, or redirecting users to malicious external domains. This issue is identified as an incomplete-fix case, as previous security patches focused on link helpers while overlooking the ANSI processing logic. The vulnerability affects all versions of Allure 2 prior to 2.39.0."
}