CVE-2026-58191 Details
Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
A reflected cross-site scripting vulnerability has been identified in the Appium automation framework, specifically in the base-driver component, prior to version 10.7.0. The issue arises because the base-driver unconditionally mounts certain test routes, including '/test/guinea-pig', '/test/guinea-pig-scrollable', and '/test/guinea-pig-app-banner', on every server. The vulnerability is introduced when the handler reflects the 'throwError' query parameter, 'comments' POST field, and 'User-Agent' request header into the returned HTML without proper escaping. This lack of sanitization allows for the execution of arbitrary JavaScript on the server's origin. The vulnerability does not require authentication, a session, a driver, or a plugin, and the default bind address is '0.0.0.0'.
Users can upgrade to Appium base-driver version 10.7.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-489 | Active Debug Code | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appium appium/base-driver | < 10.7.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |