Executive brief
Apache Allura is a web-based project management and collaboration platform used for open-source software development. A stored cross-site scripting (XSS) vulnerability in its markdown HTML processing allows authenticated or unauthenticated attackers to inject malicious scripts that execute in the browsers of other users who view the affected content, potentially leading to account compromise, credential theft, or malicious actions performed on behalf of victims.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Apache Allura's markdown HTML processing engine. The vulnerability arises from improper sanitization of user-supplied markdown input, allowing attackers to inject arbitrary HTML and JavaScript code that persists in the application's database. When other users view content containing the malicious payload, the script executes in their browser context with the privileges of the authenticated user. The vulnerability affects all versions through 1.20.0; patched version 1.21.0 is available.
Affected products
- Apache Allura through 1.20.0
Timeline
- 2026-09-03: disclosed
- 2026-09-04: patched: Version 1.21.0 released with fix