Executive brief
Allure Report is a tool used to generate visual reports from software test results. A vulnerability allows an attacker to inject malicious scripts into these reports via specially crafted test failure messages. If a user views a compromised report, the script could steal login cookies or sensitive data, especially when reports are hosted on shared corporate CI/CD platforms like Jenkins or GitLab.
Technical details
A stored XSS vulnerability exists in the `ansi.js` Handlebars helper of `allure-generator`. The helper uses the `ansi-to-html` library to process `statusMessage` and `statusTrace` fields from test result files (such as JUnit XML) but does not enable the `escapeForHtml` option. Furthermore, the output is wrapped in a Handlebars `SafeString`, bypassing default template escaping. An attacker can provide malicious input via XML attributes in test results, leading to arbitrary JavaScript execution in the context of the report viewer's browser. This is an incomplete fix for a previous XSS issue that addressed other helpers but missed the ANSI helper. A patch is available in version 2.39.0.
Affected products
- allure-framework allure-generator <= 2.38.1
Timeline
- 2026-06-16: disclosed
- 2026-06-19: advisory: GitHub Advisory published
- 2026-06-19: patched: Version 2.39.0 released