CVE-2026-58191: Appium Base-Driver XSS Vulnerability

CVE-2026-58191 Overview

CVE-2026-58191 is a reflected cross-site scripting (XSS) vulnerability in Appium, a cross-platform automation framework built on top of the W3C WebDriver protocol. Versions prior to 10.7.0 unconditionally mount the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes in the base-driver component. The compileLodashTemplate function reflects the throwError query parameter, the comments POST field, and the User-Agent request header into HTML output without escaping. Attackers can inject arbitrary JavaScript that executes on the server origin. The vulnerability is classified under CWE-79 and is fixed in version 10.7.0.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of the Appium server origin, enabling session theft, WebDriver command hijacking, and further compromise of automation infrastructure.

Affected Products

Appium base-driver versions prior to 10.7.0
Appium servers exposing the test guinea-pig routes
Automation environments running vulnerable Appium builds

Discovery Timeline

2026-07-08 - CVE-2026-58191 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58191

Vulnerability Analysis

Appium's base-driver ships three test routes intended for internal automation validation: /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner. These routes are mounted unconditionally, meaning they remain reachable on production Appium server deployments. The routes render HTML using the internal compileLodashTemplate helper.

The helper inserts three attacker-controllable inputs directly into the returned HTML without contextual output encoding. The reflected values are the throwError URL query parameter, the comments field from a POST body, and the User-Agent header. Any of these inputs can carry an HTML <script> element or event handler payload that executes when the response renders in a browser.

Because execution occurs on the Appium server origin, attacker JavaScript can read same-origin resources, issue WebDriver commands to /session endpoints, and pivot into any device or app under automation control.

Root Cause

The root cause is missing output escaping in compileLodashTemplate. Lodash template interpolation with <%= %> performs no HTML entity encoding, while <%- %> would. The template reflects untrusted request data as raw HTML, which produces a classic reflected XSS sink. Combined with routes that are always mounted, the sink is reachable without authentication.

Attack Vector

An attacker crafts a URL targeting one of the guinea-pig routes on a reachable Appium server. The URL embeds a JavaScript payload in the throwError parameter, or the attacker submits a POST with a malicious comments value, or sends a request with a scripted User-Agent. When a victim with browser access to the Appium host loads the response, the script runs under the Appium server origin. Exploitation requires user interaction, consistent with reflected XSS delivery through phishing or forced navigation.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-3wgp-x9p5-c7cc for vendor technical details.

Detection Methods for CVE-2026-58191

Indicators of Compromise

HTTP requests to /test/guinea-pig, /test/guinea-pig-scrollable, or /test/guinea-pig-app-banner on Appium hosts
Query strings containing throwError= with <script>, onerror=, or URL-encoded HTML tag characters
POST bodies to guinea-pig routes carrying a comments field with HTML or JavaScript syntax
Anomalous User-Agent headers containing angle brackets, javascript: URIs, or template delimiters

Detection Strategies

Inspect web server and reverse proxy logs for requests to guinea-pig routes and flag any with script-like reflected inputs
Add web application firewall signatures for reflected XSS payloads targeting throwError, comments, and User-Agent on Appium endpoints
Correlate Appium HTTP access logs with browser telemetry to identify victims that rendered attacker payloads

Monitoring Recommendations

Alert on any exposure of Appium test routes to networks outside the CI or automation lab
Track Appium version strings in build pipelines and flag hosts running versions prior to 10.7.0
Monitor outbound requests from automation hosts for unexpected callbacks that would indicate successful script execution

How to Mitigate CVE-2026-58191

Immediate Actions Required

Upgrade Appium and its base-driver dependency to version 10.7.0 or later across all automation hosts
Restrict network access to Appium servers so that only trusted CI runners and test orchestrators can reach the HTTP interface
Audit historical logs for requests to the guinea-pig routes with reflected script payloads

Patch Information

Appium fixed the issue in base-driver version 10.7.0. The fix addresses both the unconditional mounting of the guinea-pig routes and the unsafe reflection performed by compileLodashTemplate. Refer to the Appium GitHub Security Advisory for the release notes and commit references.

Workarounds

Bind the Appium server to 127.0.0.1 and require an SSH tunnel or authenticated reverse proxy for remote access
Block requests to /test/guinea-pig* paths at an upstream reverse proxy until the upgrade is deployed
Enforce a strict Content Security Policy on any browser client that must interact with Appium hosts

bash

# Example NGINX rule blocking guinea-pig test routes on Appium hosts
location ~* ^/test/guinea-pig(-scrollable|-app-banner)?(/|$) {
    return 404;
}