CVE-2026-58500 Details
Description
MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc, resource-id, and locator selector values — directly into an HTML template literal without any HTML or JavaScript context escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the generate_locators tool. When a victim's MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via window.parent.postMessage, leading to unauthorized MCP tool execution such as taking screenshots, reading page source, or any other registered capability. This issue has been fixed in version 1.85.10.
A cross-site scripting (XSS) vulnerability has been identified in Appium MCP versions prior to 1.85.10. The issue arises in the createLocatorGeneratorUI function, which fails to properly escape user-controlled element attributes—such as text, content description, resource ID, and locator selector values—before inserting them into an HTML template. This oversight allows an attacker to inject arbitrary HTML and JavaScript into the MCP UI resource generated by the 'generate_locators' tool. When this resource is rendered by the MCP client, the injected script executes, potentially misusing MCP tools through window.parent.postMessage. This could lead to unauthorized actions like taking screenshots, accessing page source, or using any other registered capability.
Users can update to Appium MCP version 1.85.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appium/appium-mcp/security/advisories/GHSA-x975-rgx4-5fh4 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/appium/appium-mcp/commit/e222bbbd6fe2b656a320efcd143563f08061a83d | [email protected] | Patch |
| https://github.com/appium/appium-mcp/security/advisories/GHSA-x975-rgx4-5fh4 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appium appium-mcp | <= 1.85.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |