Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M
CVE-2026-58191Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Medium 6.5
In plain English
A medium-severity cross-site scripting in appium from appium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @appium/base-driver | 10.7.0 | GHSA-3wgp-x9p5-c7cc |
Affected products (as reported)
Weakness: CWE-79, CWE-489 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc x_refsource_CONFIRM