Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting

Appium = 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests. id: CVE-2026-58191 info: name:...

Appium Desktop Server - Remote Code Execution

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4. id: CVE-2023-2479 info: name: Appium Desktop Server - Remote Code Execution author: zn9988 severity: critical description: | OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4...

Cross-site Scripting (XSS)

Appium is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized reflection of user-controlled query parameters, POST fields, and HTTP headers into HTML, which allows an attacker to execute arbitrary JavaScript on the server origin...

CVE-2026-58191

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:09+00:00| published-proof-of-concept| https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc 2026-09-14 21:00:06+00:00| confirmed|...

@appium/base-plugin (>=3.2.0, <=3.3.0), @appium/fake-plugin (>=4.2.0, <=4.3.0) +8 more potentially affected by CVE-2026-58191 via @appium/base-driver (>=10.3.0, <=10.6.0)

@appium/base-driver NPM version =10.3.0, =3.2.0, =4.2.0, =3.0.10, =2.107.37, =2.107.37, =3.3.0, =0.1.0-beta.1, =0.79.0, =1.0.96, =1.0.115 Source cves: CVE-2026-58191 Source advisory: OSV:GHSA-3WGP-X9P5-C7CC...

EUVD-2026-42425

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig routes...

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Summary Appium's base-driver mounts the built-in /test/guinea-pig, /test/guinea-pig-scrollable and /test/guinea-pig-app-banner routes unconditionally on every server. The handler reflects the throwError query param, the comments POST field, and the User-Agent request header into the returned HTML...

GHSA-3WGP-X9P5-C7CC Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Summary Appium's base-driver mounts the built-in /test/guinea-pig, /test/guinea-pig-scrollable and /test/guinea-pig-app-banner routes unconditionally on every server. The handler reflects the throwError query param, the comments POST field, and the User-Agent request header into the returned HTML...

CVE-2026-84201

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

CVE-2026-84201 appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

CVE-2026-84201 appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

CVE-2026-84201

appium-mcp-server through 0.1.61 is affected by a path traversal vulnerability in the write_file and write_files_batch tools. The server fails to validate or normalize file paths, allowing an attacker to supply absolute paths or relative paths with parent-directory segments to write files outside...

EUVD-2026-69288

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

Malicious Package

Overview @testrelic/appium-analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-84299

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write file and write files batch tools, allowing attackers to write files outside the intended PROJECT ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrit...

CVE-2026-84201: Improper Limitation of a Pathname to a Restricted Directory

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

Malicious code in @testrelic/appium-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...

MAL-2026-15647 Malicious code in @testrelic/appium-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...

CVE-2026-43910

creationtimestamp| type| source ---|---|--- 2026-07-28 16:35:12+00:00| published-proof-of-concept| https://github.com/appium/java-client/security/advisories/GHSA-28f5-38xr-jh2w...

CVE-2026-43910 Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...