Answer in brief
CVE-2026-55847 records a Medium severity (CVSS 6.1) vulnerability in Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering. The current sources do not mark it as known exploited. The current feed maps allure-framework/allure2 (generic), io.qameta.allure/allure-generator (generic), io.qameta.allure:allure-generator (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps allure-framework/allure2 (generic), io.qameta.allure/allure-generator (generic), io.qameta.allure:allure-generator (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| allure-framework/allure2generic | <2.39.0 | 2.39.0 |
| io.qameta.allure/allure-generatorgeneric | <2.39.0 | 2.39.0 |
| io.qameta.allure:allure-generatormaven | <=2.38.1 | 2.39.0 |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps the result in Handlebars SafeString, disabling template auto-escaping in allure-generator/src/main/javascript/blocks/status-details/status-details.hbs. JunitXmlPlugin.java can populate these fields directly from crafted JUnit XML failure messages and traces, and equivalent input flows exist in the TRX, xUnit XML, xctest, and Allure1 and Allure2 plugins. When a user views the affected status details, unescaped markup executes arbitrary JavaScript in the report origin, which can expose report data and compromise sessions associated with that origin. This is an incomplete-fix case because PR 3271 escaped link helpers but did not address the ANSI helper. This issue is fixed in version 2.39.0.
Quoted source text, attributed separately from HOL analysis.