Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The ansi.js Handlebars helper in allure-generator passes user-controlled statusMessage and statusTrace values from test result files through the ansi-to-html library and wraps the output in Handlebars SafeString without HTML escaping. Since ansi-to-html does not escape HTML entities by default, an attacker who can influence test result content (e.g., via crafted JUnit XML failure messages) can inject arbitrary JavaScript that executes when anyone views the generated Allure report. Details The vulnerability is an incomplete fix — commit 4c64b19 (PR #3271) fixed XSS in linky.js and text-with-links.js by adding escapeExpression(), but the same pattern in ansi.js was not addressed. Vulnerable sink — allure-generator/src/main/javascript/helpers/ansi.js:10-11: The AnsiToHtml constructor at line 4 does not set escapeForHtml: true: The ansi-to-html library (v0.7.2) defaults escapeForHtml to false, meaning HTML entities in the input pass through unchanged. Wrapping the result in…
Recommended action: Upgrade to 2.39.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Allure report generator is vulnerable to an arbitrary file read via path traversal when processing test results. An attacker can craft a malicious result file (-result.json, -container.json, or .plist) that points an attachment source to a sensitive file on the host system. During report generation, Allure will resolve these paths and include the sensitive files in the final report. Details The vulnerability exists in several plugins where attachment paths are resolved using unvalidated user input. The code uses Path.resolve() without normalizing the path or checking if the resulting file remains within the intended results directory. Affected Files and Lines: Allure2Plugin.java (Line 264): final Path attachmentFile = source.resolve(attachment.getSource()); Allure1Plugin.java (Line 328): final Path attachmentFile = source.resolve(attachment.getSource()); XcTestPlugin.java (Line 181): attachments.resolve(String.format("Screenshot%s.%s", uuid, ext)) Since resolve() allows…
Recommended action: Upgrade to 2.38.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.