{"action":"Upgrade io.qameta.allure:allure-generator to 2.39.0 or later.","affected":[{"fixed":"2.39.0","introduced":"0"}],"component":"io.qameta.allure:allure-generator","cve_ids":["CVE-2026-55847"],"ecosystem":"Maven","epss":0.00338,"exploited":false,"fixed_versions":["2.39.0"],"ghsa_id":"GHSA-gx93-m64w-5m6h","id":"tcs_01M5N8Z8RBCS3WA3N85ERTX78G","modified_at":"2026-06-19T21:41:32.737161Z","published_at":"2026-06-19T21:15:53Z","references":["https://osv.dev/vulnerability/GHSA-gx93-m64w-5m6h","https://github.com/allure-framework/allure2/security/advisories/GHSA-gx93-m64w-5m6h","https://github.com/allure-framework/allure2"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-gx93-m64w-5m6h","url":"https://osv.dev/vulnerability/GHSA-gx93-m64w-5m6h"}],"summary":"Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering"}