85 matches found
CVE-2026-84669
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...
CVE-2026-84669
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...
CVE-2026-84669
A path traversal vulnerability exists in the Jenkins Allure Plugin version 2.35.2 and earlier . The flaw occurs because the plugin fails to correctly validate file paths when serving Allure report results. Attackers possessing Item/Read permissions on jobs that publish Allure reports can exploit ...
EUVD-2026-70137
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...
CVE-2026-84669
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...
PT-2026-84792
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...
Path traversal vulnerability in allure-jenkins-plugin
allure-jenkins-plugin 2.35.2 and earlier does not correctly validate file paths when serving Allure report results. This allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system. allure-jenkins-plugin...
CVE-2026-84669: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system...
Malicious Package
Overview boxy-fixture-allure is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-12342 Malicious code in boxy-fixture-allure (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...
Malicious code in boxy-fixture-allure (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...
pytest-allure-adaptor (>=1.7.2, <=1.7.6) potentially affected by CVE-2025-71176 via pytest (2.9.0)
pytest PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - pytest-allure-adaptor =1.7.2, =1.7.6 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...
GHSA-GX93-M64W-5M6H Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Summary The ansi.js Handlebars helper in allure-generator passes user-controlled statusMessage and statusTrace values from test result files through the ansi-to-html library and wraps the output in Handlebars SafeString without HTML escaping. Since ansi-to-html does not escape HTML entities by...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Allure2Plugin and Allure1Plugin description HTML handling, and through CategoriesPlugin category description HTML in the report aggregation components. An attacker can inject malicious HTML or...
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Summary The ansi.js Handlebars helper in allure-generator passes user-controlled statusMessage and statusTrace values from test result files through the ansi-to-html library and wraps the output in Handlebars SafeString without HTML escaping. Since ansi-to-html does not escape HTML entities by...
Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
Summary The built-in HTTP server started by allure serve and allure open is vulnerable to path traversal. The server resolves request URI paths directly against the report directory without normalizing or validating that the resolved path stays within the report directory. An attacker who can rea...
GHSA-82CG-3HV7-74GC Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
Summary The built-in HTTP server started by allure serve and allure open is vulnerable to path traversal. The server resolves request URI paths directly against the report directory without normalizing or validating that the resolved path stays within the report directory. An attacker who can rea...
PT-2026-51118
Summary The ansi.js Handlebars helper in allure-generator passes user-controlled statusMessage and statusTrace values from test result files through the ansi-to-html library and wraps the output in Handlebars SafeString without HTML escaping. Since ansi-to-html does not escape HTML entities by...
PT-2026-51117
Name of the Vulnerable Software and Affected Versions Allure 2 versions prior to 2.39.0 Description The built-in HTTP server started by allure serve and allure open is susceptible to path traversal. The server uses URI.getPath within the setUpServer function to resolve request paths against the...
CVE-2026-55847
creationtimestamp| type| source ---|---|--- 2026-06-16 13:42:25+00:00| published-proof-of-concept| https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h 2026-09-14 18:42:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7sny77l36bfpy...