{"id":"CVE-2026-58191","aliases":["EUVD-2026-42425","GHSA-3wgp-x9p5-c7cc"],"status":"published","title":"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes","description":"Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00564,"percentile":0.47225,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-489","CWE-79"],"published":"2026-07-08T20:57:43Z","modified":"2026-10-28T02:30:59Z","exploits":[{"source":"nuclei","id":"CVE-2026-58191","title":"Appium base-driver \u003c=10.6.0 - Reflected Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58191.yaml"}],"fixes":[{"ecosystem":"npm","package":"@appium/base-driver","fixed_in":["10.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@appium/base-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.6.0"},{"fixed":"10.7.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@appium/base-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.7.0"}]}]}],"products":[{"vendor":"appium","product":"appium"},{"vendor":"appium","product":"appium\\/base-driver"}],"references":[{"url":"https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58191","tags":["advisory"]},{"url":"https://github.com/appium/appium/pull/22394","tags":["web"]},{"url":"https://github.com/appium/appium/commit/d94a40af9f8040191ee7888571a1c9d5aec59f89","tags":["web"]},{"url":"https://github.com/appium/appium/releases/tag/@appium/base-driver@10.7.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3wgp-x9p5-c7cc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58191.json","tags":["advisory"]},{"url":"https://github.com/appium/appium","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-58191","title":"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes","description":"Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.","status":"published","published":"2026-07-08T20:57:43.237Z","modified":"2026-07-09T14:40:38.011Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79","CWE-489"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-42425","description":"Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.","status":"published","published":"2026-07-08T20:57:43Z","modified":"2026-07-09T14:40:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:04.126011Z"}],"ghsa":[{"id":"GHSA-3wgp-x9p5-c7cc","title":"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes","description":"## Summary\n\nAppium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea-pig-app-banner` routes **unconditionally** on every server. The handler reflects the `throwError` query param, the `comments` POST field, and the `User-Agent` request header into the returned HTML via `compileLodashTemplate`, which interpolates `\u003c%= expr %\u003e` as `String(expr)` with **no HTML/JS escaping**. This yields reflected XSS, and the `throwError` value is reflected **inside a `\u003cscript\u003e` block**, giving arbitrary JavaScript execution on the server's origin. No authentication, no session, no driver and no plugin are required, and the default bind address is `0.0.0.0`.\n\n## Details\n\n### Affected\n- `@appium/base-driver` **10.6.0** (with Appium server **3.5.0**); tested live.\n- Template engine helper: `@appium/base-driver` `lib/utils.ts` `compileLodashTemplate`.\n\n### Location (file:line)\n- Routes mounted unconditionally: `base-driver/lib/express/server.ts:216-219`\n(`app.all('/test/guinea-pig', guineaPig)` etc.).\n- Tainting: `base-driver/lib/express/static.ts:35-61` (`guineaPigTemplate`) —\n`throwError = String(req.params.throwError ?? req.query?.throwError)`, `params.comment = String(req.body.comments)`, `params.userAgent = req.headers['user-agent']`.\n- Unescaped render: `base-driver/lib/utils.ts:67-83` (`compileLodashTemplate`)\nemits `\u003c%= expr %\u003e` as `String(${expr})` via `new Function(...)`, no escaping.\n- Sinks (shipped templates): `base-driver/static/test/guinea-pig.html:11-12`\n(`throwError` inside `\u003cscript\u003e`), `:50` (`comment`), `:87` (`userAgent`); same in `guinea-pig-scrollable.html` / `guinea-pig-app-banner.html`.\n\n\n### PoC\n\nRequests:\n```\nGET /test/guinea-pig?throwError=x%27%2balert(document.domain)%2b%27\nPOST /test/guinea-pig         (body: comments=\u003c/span\u003e\u003cimg src=x onerror=alert(1)\u003e)\nGET  /test/guinea-pig         (header: User-Agent: \u003cscript\u003ealert(7)\u003c/script\u003e)\n```\n\n\u003cimg width=\"973\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f58e1dce-f3ad-43d3-b66e-1ff5efea3866\" /\u003e\n\n\n### Impact\n\nAn attacker who can get a victim to open a crafted link (or auto-submit a form) to the Appium server executes arbitrary JavaScript on the server's origin. With default CORS `*` + no authentication, that JS can drive the WebDriver REST API and plugin endpoints. The endpoints are debug/test fixtures that should not be reachable on a production listener at all.","status":"published","published":"2026-09-01T18:54:53Z","modified":"2026-09-01T18:54:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79","CWE-489"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-58191","description":"Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.","status":"published","published":"2026-07-08T21:16:52.013Z","modified":"2026-07-15T20:31:32.807Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-489"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-58191","title":"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes","description":"Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.","status":"published","published":"2026-07-08T20:57:43.237Z","modified":"2026-10-28T02:30:59.317061255Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-489","CWE-79"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"GHSA-3wgp-x9p5-c7cc","title":"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes","description":"## Summary\n\nAppium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea-pig-app-banner` routes **unconditionally** on every server. The handler reflects the `throwError` query param, the `comments` POST field, and the `User-Agent` request header into the returned HTML via `compileLodashTemplate`, which interpolates `\u003c%= expr %\u003e` as `String(expr)` with **no HTML/JS escaping**. This yields reflected XSS, and the `throwError` value is reflected **inside a `\u003cscript\u003e` block**, giving arbitrary JavaScript execution on the server's origin. No authentication, no session, no driver and no plugin are required, and the default bind address is `0.0.0.0`.\n\n## Details\n\n### Affected\n- `@appium/base-driver` **10.6.0** (with Appium server **3.5.0**); tested live.\n- Template engine helper: `@appium/base-driver` `lib/utils.ts` `compileLodashTemplate`.\n\n### Location (file:line)\n- Routes mounted unconditionally: `base-driver/lib/express/server.ts:216-219`\n(`app.all('/test/guinea-pig', guineaPig)` etc.).\n- Tainting: `base-driver/lib/express/static.ts:35-61` (`guineaPigTemplate`) —\n`throwError = String(req.params.throwError ?? req.query?.throwError)`, `params.comment = String(req.body.comments)`, `params.userAgent = req.headers['user-agent']`.\n- Unescaped render: `base-driver/lib/utils.ts:67-83` (`compileLodashTemplate`)\nemits `\u003c%= expr %\u003e` as `String(${expr})` via `new Function(...)`, no escaping.\n- Sinks (shipped templates): `base-driver/static/test/guinea-pig.html:11-12`\n(`throwError` inside `\u003cscript\u003e`), `:50` (`comment`), `:87` (`userAgent`); same in `guinea-pig-scrollable.html` / `guinea-pig-app-banner.html`.\n\n\n### PoC\n\nRequests:\n```\nGET /test/guinea-pig?throwError=x%27%2balert(document.domain)%2b%27\nPOST /test/guinea-pig         (body: comments=\u003c/span\u003e\u003cimg src=x onerror=alert(1)\u003e)\nGET  /test/guinea-pig         (header: User-Agent: \u003cscript\u003ealert(7)\u003c/script\u003e)\n```\n\n\u003cimg width=\"973\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f58e1dce-f3ad-43d3-b66e-1ff5efea3866\" /\u003e\n\n\n### Impact\n\nAn attacker who can get a victim to open a crafted link (or auto-submit a form) to the Appium server executes arbitrary JavaScript on the server's origin. With default CORS `*` + no authentication, that JS can drive the WebDriver REST API and plugin endpoints. The endpoints are debug/test fixtures that should not be reachable on a production listener at all.","status":"published","published":"2026-09-01T18:54:53Z","modified":"2026-09-01T19:02:52.96140066Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-489","CWE-79"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}