CVE-2026-58191 Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate...

CVE-2026-58192

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

EUVD-2026-42424

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

CVE-2026-58192 Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

CVE-2026-58192 Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

CVE-2026-58192

Appium 's @appium/storage-plugin (prior to version 1.1.6 ) is vulnerable to a directory traversal in the POST /storage/delete handler. The handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated ...

CVE-2026-58192: Improper Limitation of a Pathname to a Restricted Directory

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

PT-2026-56609

Name of the Vulnerable Software and Affected Versions Appium versions prior to 1.1.6 Description The Appium storage plugin contains a flaw where the handler for the 'POST /storage/delete' endpoint passes the user-supplied name variable directly into path.joinstorageRoot, name and the fs.rimraf...

CVE-2026-58191: Improper Neutralization of Input During Web Page Generation

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate...

PT-2026-56608

Name of the Vulnerable Software and Affected Versions Appium versions prior to 10.7.0 Description The base-driver unconditionally mounts the '/test/guinea-pig', '/test/guinea-pig-scrollable', and '/test/guinea-pig-app-banner' endpoints. The compileLodashTemplate function reflects the throwError...

Cross-site Scripting (XSS)

Overview appium-mcp is an Intelligent MCP server providing AI assistants with powerful tools and resources for Appium mobile automation Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createLocatorGeneratorUI function. An attacker can execute arbitrary...

PT-2026-57883

Name of the Vulnerable Software and Affected Versions MCP Appium versions prior to 1.85.10 Description The createLocatorGeneratorUI function fails to escape HTML or JavaScript context when interpolating element attributes—specifically text, content-desc, resource-id, and locator selector...

@adobe/helix-importer-jcr-packaging (>=2.0.2, <=2.0.16), @aidin36/xmp (>=0.1.0, <=0.2.2) +51 more potentially affected by CVE-2026-41675 via @xmldom/xmldom (>=0.9.0, <=0.9.9)

@xmldom/xmldom NPM version =0.9.0, =2.0.2, =0.1.0, =5.5.3, =1.0.22, =1.35.0, =1.5.1-beta.1723, =0.1.0, =2.1.2, =2.6.1, =2.98.0, =2.0.0, =2.2.0, =2.108.11 and more Source cves: CVE-2026-41675 Source advisory: SNYK:JS-XMLDOMXMLDOM-16134552...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the @appium/support package

Summary Due to the use of the @appium/support package, DevOps Test Performance and Rational Performance Tester contain a potential path traversal vulnerability CVE-2026-30973, Vulnerability Details CVEID:CVE-2026-30973 DESCRIPTION: Appium is an automation framework that provides WebDriver-based...

CVE-2026-30973

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The chec...

EUVD-2026-10709

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction...

EUVD-2026-10710

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction...

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction

Summary @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with...

GHSA-RFX7-4XW3-GH4M @appium/support has a Zip Slip arbitrary file write in its ZIP extraction

Summary @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with...

Directory Traversal

Overview @appium/support is a Support libs used across Appium packages Affected versions of this package are vulnerable to Directory Traversal in the extractAllTo function. An attacker can write arbitrary files outside the intended extraction directory by supplying a crafted ZIP archive containin...