Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting

Appium = 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests. id: CVE-2026-58191 info: name:...

Appium Desktop Server - Remote Code Execution

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4. id: CVE-2023-2479 info: name: Appium Desktop Server - Remote Code Execution author: zn9988 severity: critical description: | OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4...

GHSA-QFXX-C367-67F8 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...

EUVD-2026-101529

Appium: Symlink based Zip Slip in @appium/support ZIP extraction...

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...

@appium/base-driver (>=10.3.0, <=10.7.1), @appium/base-plugin (>=3.2.0, <=3.3.2) +19 more potentially affected by CVE-2026-103975 +1 more via @appium/support (>=7.1.0, <=7.2.5)

@appium/support NPM version =7.1.0, =10.3.0, =3.2.0, =2.3.0, =6.0.4, =4.2.0, =4.2.0, =1.1.0, =4.1.0, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =2.107.37, =2.107.37, =2.136.0 - @silakagent/android-runner 0.1.0 and more Source cves: CVE-2026-103975, CVE-2026-30973 Source advisory: GHSA-QFXX-C367-67F8...

Symlink Attack

Overview @appium/support is a Support libs used across Appium packages Affected versions of this package are vulnerable to Symlink Attack via the ZIP extraction logic in zip.ts when processing archive entries that contain symlinks pointing outside the destination directory. An attacker who suppli...

@appium/base-driver (>=10.3.0, <=10.7.1), @appium/base-plugin (>=3.2.0, <=3.3.2) +19 more potentially affected by CVE-2026-103975 via @appium/support (>=7.1.0, <=7.2.5)

@appium/support NPM version =7.1.0, =10.3.0, =3.2.0, =2.3.0, =6.0.4, =4.2.0, =4.2.0, =1.1.0, =4.1.0, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =2.107.37, =2.107.37, =2.136.0 - @silakagent/android-runner 0.1.0 and more Source cves: CVE-2026-103975 Source advisory: OSV:GHSA-QFXX-C367-67F8...

@appium/base-driver (>=10.3.0, <=10.7.1), @appium/base-plugin (>=3.2.0, <=3.3.2) +19 more potentially affected by CVE-2026-103975 via @appium/support (>=7.1.0, <=7.2.5)

@appium/support NPM version =7.1.0, =10.3.0, =3.2.0, =2.3.0, =6.0.4, =4.2.0, =4.2.0, =1.1.0, =4.1.0, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =2.107.37, =2.107.37, =2.136.0 - @silakagent/android-runner 0.1.0 and more Source cves: CVE-2026-103975 Source advisory: SNYK:JS-APPIUMSUPPORT-21193882...

CVE-2026-103975

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

@appium/base-driver (>=10.5.0, <=10.7.1), @appium/base-plugin (>=3.2.2, <=3.3.2) +15 more potentially affected by CVE-2026-103975 via @appium/support (>=7.2.0, <=7.2.5)

@appium/support NPM version =7.2.0, =10.5.0, =3.2.2, =2.4.0, =6.0.4, =4.2.2, =4.2.2, =1.1.2, =4.1.2, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =3.4.0, =0.1.0-beta.1, =0.1.0-beta.15 and more Source cves: CVE-2026-103975 Source advisory: MEND:CVE-2026-103975...

CVE-2026-103975

The @appium/support component in Appium (prior to version 7.2.6 ) is vulnerable to an arbitrary file write via a symlink-based ZIP Slip . The root cause is that the ZIP extraction process fails to validate the symlink target or the real destination during a lexical containment check. An attacker-...

CVE-2026-103975: Improper Link Resolution Before File Access

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

PT-2026-113963

Name of the Vulnerable Software and Affected Versions Appium versions prior to 7.2.6 Description ZIP extraction in @appium/support allows an archive entry to create a symbolic link to a location outside the extraction directory. A subsequent regular-file entry can then resolve through this link...

@ache-lol/cli (>=0.1.97, <=0.1.99), @ada-mcp/mcp-server (>=0.1.0, <=0.1.1) +192 more potentially affected by CVE-2026-102422 via shell-quote (>=1.8.4, <=1.10.0)

shell-quote NPM version =1.8.4, =0.1.97, =0.1.0, =0.1.0, =0.0.13, =14.0.13, =10.0.0-rc.2, =3.0.0-beta.0, =1.0.0, =2.0.0-rc.1, =6.0.4, =4.0.0-rc.1, =1.0.0-beta.0, =4.0.0-rc.1, =1.0.0, =1.0.15 and more Source cves: CVE-2026-102422 Source advisory: GHSA-PQG4-J6R4-53MV...

Cross-site Scripting (XSS)

Appium is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized reflection of user-controlled query parameters, POST fields, and HTTP headers into HTML, which allows an attacker to execute arbitrary JavaScript on the server origin...