CVE-2026-55847: 
Java vulnerability analysis and mitigation

CVE-2026-55847 is a stored Cross-Site Scripting (XSS) vulnerability in the allure-generator component of the Allure Report framework (Maven package io.qameta.allure:allure-generator). The flaw allows an attacker who can influence test result content — such as JUnit XML failure messages — to inject arbitrary JavaScript that executes in the browser of anyone viewing the generated Allure report. All versions up to and including 2.38.1 are affected; version 2.39.0 contains the fix. It was published on June 16, 2026, and has a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Allure2 Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The ansi.js Handlebars helper in allure-generator passes user-controlled statusMessage and statusTrace values through the ansi-to-html library (v0.7.2), which defaults escapeForHtml to false, meaning raw HTML entities pass through unchanged. The output is then wrapped in Handlebars SafeString, which explicitly suppresses Handlebars' auto-escaping, delivering unescaped HTML directly to the browser. This is an incomplete fix: a prior commit (4c64b19, PR #3271) added escapeExpression() to linky.js and text-with-links.js but left the identical pattern in ansi.js unaddressed. The vulnerable sink is allure-generator/src/main/javascript/helpers/ansi.js:10-11, and the tainted data originates from XML attributes read without sanitization in JunitXmlPlugin.java:307-308; the same pattern exists in TRX, xUnit XML, xctest, and Allure1/2 plugins (GitHub Advisory).

Successful exploitation results in arbitrary JavaScript execution in the browser of any user who views the generated Allure report. This can lead to cookie theft and session hijacking if the report is hosted on a domain with active sessions (e.g., Jenkins, GitLab, or GitHub Actions CI dashboards), as well as full data exfiltration of report content to an attacker-controlled server. Attack vectors include malicious dependencies throwing crafted exception messages, CI pipelines processing test results from untrusted pull requests, or contributors submitting test files with XSS payloads (Allure2 Advisory).

A public proof-of-concept is included in the official advisory, demonstrating exploitation via a crafted JUnit XML file with an HTML payload in the stack trace field (e.g., <img src=x onerror=alert('statusTrace_XSS')>). No privileges are required to craft the malicious test result file, though a victim must open the generated report (user interaction required). No in-the-wild exploitation, threat actor attribution, or CISA KEV listing has been reported at this time (GitHub Advisory).

1. Craft malicious test result: Create a JUnit XML file with an XSS payload embedded in the message attribute or element value of a <failure> or <error> tag, e.g.:

<testcase name="evil">
  <failure message="&lt;img src=x onerror=alert('XSS')&gt;">Stack trace: &lt;img src=x onerror=alert('statusTrace_XSS')&gt;</failure>
</testcase>

2. Introduce the file into the CI pipeline: Submit the malicious XML as a test result artifact — via a pull request, a compromised dependency that throws crafted exception messages, or direct file placement in the results directory.
3. Trigger report generation: The CI system runs allure generate /path/to/results/ -o /output/allure-report, causing JunitXmlPlugin to read the unsanitized message attribute and element value into statusMessage and statusTrace.
4. Payload reaches the browser: When the report is rendered, status-details.hbs calls {{ansi statusMessage}} and {{ansi statusTrace}}, which passes the values through ansi-to-html (with escapeForHtml: false) and wraps them in SafeString, bypassing Handlebars escaping.
5. Victim views the report: Any user who opens the Allure report and navigates to the affected test case triggers the injected JavaScript, enabling cookie theft, session hijacking, or data exfiltration (Allure2 Advisory).

• File System: JUnit XML (or TRX, xUnit XML, xctest, Allure1/2 result) files containing HTML tags or JavaScript event handlers (e.g., onerror=, <script>, <img src=x) in message attributes or stack trace values.
• Generated Report Files: Allure report HTML files (e.g., index.html, test case detail pages) containing unescaped <script> blocks or inline event handlers within status detail sections.
• Network: Outbound HTTP requests from a report viewer's browser to unexpected external domains shortly after opening an Allure report, potentially carrying exfiltrated cookie or session data.
• Logs: CI pipeline logs showing test result files sourced from untrusted branches or external contributors that contain unusual characters (<, >, &) in failure message fields.

Upgrade io.qameta.allure:allure-generator to version 2.39.0, which fixes the vulnerability by configuring AnsiToHtml with escapeForHtml: true. No configuration-based workaround is available for unpatched versions; the only effective mitigation is upgrading. As an interim measure, restrict access to generated Allure reports to trusted users only, and avoid hosting reports from untrusted test result sources on domains with active authenticated sessions (GitHub Advisory, Allure2 Advisory).