CVE-2026-58191
Medium
Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
SeverityMedium
CVSS6.5
Exploit probability—
ProductAppium\/base-driver
PublishedJul 8, 2026
First seenJul 8, 2026
Weakness typeCWE-79Cross-site scripting (XSS)CWE-489CWE-489
How to fix
Update
- appium appium\/base-driver10.7.0 or later
- @appium/base-driver10.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| appium appium\/base-driver | v < 10.7.0 | 10.7.0 |
| @appium/base-drivernpm | v < 10.7.0 | 10.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.