Cross-Site Scripting Vulnerability in Appium Automation Framework
CVE-2026-58191

6.5MEDIUM

Key Information:

Vendor

Appium

Status
Appium
Vendor
CVE Published:
8 July 2026

What is CVE-2026-58191?

Appium, a popular cross-platform automation framework, suffers from a reflected cross-site scripting vulnerability in versions prior to 10.7.0. This flaw occurs due to the base-driver unconditionally mounting specific routes and improperly handling user input. It allows attackers to inject arbitrary JavaScript via the throwError query parameter, comments in POST fields, or the User-Agent header, leading to potential malicious execution on the server's origin. Users are urged to update to version 10.7.0 or later to mitigate this security risk.

Affected Version(s)

appium < 10.7.0

References

https://github.com/appium/appium/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.