Homepage

io.qameta.allure:allure-generator@2.38.0

  • latest version

    2.45.0

  • latest non vulnerable version

    2.45.0

  • first published

    9 years ago

  • latest version published

    13 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.qameta.allure:allure-generator package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the Allure2Plugin and Allure1Plugin description HTML handling, and through CategoriesPlugin category description HTML in the report aggregation components. An attacker can inject malicious HTML or JavaScript by supplying crafted descriptionHtml or category descriptionHtml content in Allure results files, causing the report viewer to execute an attacker-controlled script when the report is opened. This lets an attacker run a script in the user's browser in the context of the generated report, exposing report data and enabling actions as the victim within the report UI.

    How to fix Cross-site Scripting (XSS)?

    Upgrade io.qameta.allure:allure-generator to version 2.39.0 or higher.

    [,2.39.0)
    Go back to all versions of this package