CVE-2026-58191: Appium Base-Driver Reflected XSS Vulnerability (v10.7.0 Patch)

Technical summary

CVE-2026-58191 is a reflected XSS vulnerability in the compileLodashTemplate function within Appium base-driver versions before 10.7.0. The three affected routes—/test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner—are unconditionally mounted and fail to properly escape user-controlled input. Specifically, the throwError query parameter, comments POST field, and User-Agent header are reflected into HTML without HTML entity encoding or Content Security Policy protections. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-489 (Active Debug Code), indicating both input sanitization and development/test code exposure issues.

Business impact

Organizations running Appium automation frameworks are exposed to session hijacking and credential theft if an attacker convinces users (developers, testers, or operators) to click a crafted link or submit a form to an Appium server endpoint. In environments where Appium runs with elevated privileges or accesses sensitive test data, compromised JavaScript execution could lead to unauthorized data exfiltration or lateral movement within the automation pipeline. The impact is limited by the user interaction requirement (UI:R in CVSS) but remains significant in collaborative or open network environments where Appium instances are shared.

Affected systems

Appium base-driver versions prior to 10.7.0 are vulnerable. This includes all 10.x versions up to 10.6.x and any earlier releases. Any deployment running Appium as an automation server—whether for mobile app testing, web testing, or cross-platform test execution—is affected if the base-driver component has not been updated to 10.7.0 or later.

Exploitability

The vulnerability requires user interaction: a victim must click a malicious link or submit a crafted form to an Appium server endpoint. This is a reflected attack, so no server-side payload persistence is required. The attack surface is the three test routes, which may be exposed on internal networks or, in misconfigured deployments, on the internet. No authentication is needed to trigger the vulnerability, and network access is sufficient. Exploit complexity is low; an attacker needs only to craft a URL with HTML-encoded payloads in the query string or headers.

Remediation

Upgrade Appium base-driver to version 10.7.0 or later. Verify the update through your package manager and restart all Appium server instances. Organizations should also audit their Appium deployments to ensure these test routes are not exposed on untrusted networks. Consider restricting network access to Appium servers using firewall rules or VPN isolation, and enable HTTP-only and Secure cookie flags if session tokens are present.

Patch guidance

Update appium/base-driver to version 10.7.0 or later via npm, yarn, or your preferred package manager. For npm: `npm install appium@latest` or `npm install [email protected]` (or higher). Restart all running Appium server instances. Verify the patched version is in use by checking `npm list appium` or reviewing package-lock.json. Test your automation workflows after updating to confirm compatibility.

Detection guidance

Monitor HTTP requests to Appium servers for access to the three vulnerable routes: /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner. Flag requests containing suspicious query parameters (throwError with HTML/JavaScript payloads), unusual POST field values (comments with script tags or event handlers), or malformed User-Agent headers with embedded code. Web Application Firewalls (WAF) can detect HTML entity sequences or JavaScript patterns in these parameters. Server logs should be reviewed for evidence of XSS attempts or unusual traffic to test endpoints.

Why prioritize this

While the CVSS score of 6.5 (MEDIUM) reflects the user interaction requirement, the vulnerability warrants prompt patching because: (1) it affects automation infrastructure that often processes sensitive test data, (2) the attack surface is unconditionally exposed without authentication, (3) exploitation is straightforward and requires no sophisticated tooling, and (4) the patch is available and non-breaking. Prioritize this for teams using Appium in shared or network-accessible environments.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM severity assessment. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates network-exploitable attack vector, low attack complexity, no privilege required, and user interaction required. The high impact on integrity (I:H) drives the score; the attacker can execute arbitrary JavaScript. The confidentiality impact is marked as None (C:N) under the strict CVSS definition, though in practice XSS can lead to session credential theft. The lack of availability impact (A:N) reflects that the attack does not deny service.

Frequently asked questions