Threats affecting pkg:github/allure-framework/allure2

CVE-2026-55847 is a cross-site scripting (XSS) vulnerability in Allure 2, a multi-language test reporting tool. Versions prior to 2.39.0 improperly handle attacker-controlled input in the ansi.js helper by passing statusMessage and statusTrace values through AnsiToHtml without HTML escaping. This input is then wrapped in Handlebars SafeString, disabling template auto-escaping. Maliciously crafted JUnit XML failure messages and other plugin inputs can trigger this vulnerability. When a user views the affected status details, arbitrary JavaScript can execute in the report's origin, potentially exposing report data and compromising user sessions. The issue was fixed in version 2.39.0.

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Version 2.38.0 fixes the issue.

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.