Skip to content
OpenAdvisories

Vendor

allure-framework

4 known vulnerabilities.

Products

allure2 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-55847

    Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

    Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through Ansi…

    allure-framework io.qameta.allure allure2 allure-generator Ubuntu Maven
  • Medium 6.2
    CVE-2026-55846

    Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read

    Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath() in Commands.setUpServer() in allure-commandline/src/main/java/io/qameta/allu…

    allure-framework allure2 allure io.qameta.allure:allure-commandline Ubuntu Maven