Reflected XSS in Appium via Unescaped User Input

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-58191

Affected Vendors & Products

Vendor	Product	Version / Range
appium	appium	10.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-489	The product is released with debugging code still enabled or active.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to reflected cross-site scripting attacks, which allow attackers to execute arbitrary JavaScript code in the context of the server origin. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities affecting users interacting with the vulnerable Appium server.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Appium to version 10.7.0 or later, where the issue has been fixed.

Executive Summary

This vulnerability exists in Appium versions prior to 10.7.0, where the base-driver unconditionally mounts certain test routes (/test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner). The compileLodashTemplate function reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without proper escaping. This allows an attacker to perform reflected cross-site scripting (XSS) attacks, enabling arbitrary JavaScript execution on the server origin.

Hi! I’m here to help you understand CVE-2026-58191. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70