CVE-2026-58500: MCP Appium XSS Vulnerability

CVE-2026-58500 Overview

CVE-2026-58500 is a cross-site scripting (XSS) vulnerability in MCP Appium, a Model Context Protocol (MCP) server that gives AI assistants tools to automate mobile app testing on Android and iOS. The flaw resides in the createLocatorGeneratorUI function, which interpolates attacker-controlled element attributes into an HTML template literal without escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript that executes inside the victim's MCP client. The injected script can invoke MCP tools through window.parent.postMessage, enabling unauthorized tool execution. The issue is fixed in version 1.85.10.

Critical Impact
Attackers controlling a mobile app's UI can achieve unauthorized MCP tool execution, including screenshots and page source reads, by injecting script into the generate_locators tool output.

Affected Products

MCP Appium (appium-mcp) versions prior to 1.85.10
AI assistants and MCP clients that render UI resources returned by the generate_locators tool
Automated mobile testing pipelines (Android and iOS) using vulnerable MCP Appium builds

Discovery Timeline

2026-07-13 - CVE-2026-58500 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-58500

Vulnerability Analysis

The vulnerability is a stored/reflected XSS [CWE-79] in the MCP UI resource returned by the generate_locators tool. The createLocatorGeneratorUI function in src/ui/mcp-ui-utils.ts builds an HTML fragment through template literals. It interpolates element metadata such as text, contentDesc, resourceId, tagName, locator strategy names, and selector values directly into the markup with no HTML or JavaScript context escaping.

When an MCP client renders this UI resource, injected <script> payloads execute inside the client's frame. The script can call window.parent.postMessage to invoke any registered MCP tool. This turns UI content sourced from the target application into an attacker channel against the AI assistant orchestrating the test.

Root Cause

The root cause is missing output encoding for untrusted data rendered as HTML. Element attributes read from the app under test flow into an HTML template without contextual escaping. Selector values were also interpolated into an inline onclick handler using backtick-delimited strings, which allowed JavaScript context injection through crafted characters.

Attack Vector

An attacker who controls the UI of the mobile app under test sets element attributes to XSS payloads. When the AI assistant calls generate_locators, the malicious content is embedded in the returned UI resource. Rendering the resource in the MCP client executes the payload with the client's origin, enabling postMessage-based invocation of privileged MCP tools.

typescript

// Patch excerpt from src/ui/mcp-ui-utils.ts (commit e222bbb)
(element, index) => `
     <div class="locator-card" data-index="${index}">
       <div class="locator-header">
-        <h3>${element.tagName}</h3>
+        <h3>${escapeHtml(element.tagName)}</h3>
         <div class="badges">
           ${element.clickable ? '<span class="badge badge-clickable">Clickable</span>' : ''}
           ${element.enabled ? '<span class="badge badge-enabled">Enabled</span>' : ''}
           ${element.displayed ? '<span class="badge badge-displayed">Displayed</span>' : ''}
         </div>
       </div>
-      ${element.text ? `<p class="element-text"><strong>Text:</strong> ${element.text}</p>` : ''}
-      ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${element.contentDesc}</p>` : ''}
-      ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${element.resourceId}</code></p>` : ''}
+      ${element.text ? `<p class="element-text"><strong>Text:</strong> ${escapeHtml(element.text)}</p>` : ''}
+      ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${escapeHtml(element.contentDesc)}</p>` : ''}
+      ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${escapeHtml(element.resourceId)}</code></p>` : ''}
       <div class="locators-list">
         ${Object.entries(element.locators)
           .map(
             ([strategy, selector]) => `
           <div class="locator-item">
-            <span class="strategy">${strategy}</span>
-            <code class="selector">${selector}</code>
-            <button class="test-btn" onclick="testLocator('${strategy}', \`${selector.replace(/`/g, '\\`')}\`)">Test</button>
+            <span class="strategy">${escapeHtml(strategy)}</span>
+            <code class="selector">${escapeHtml(selector)}</code>
+            <button class="test-btn" data-strategy="${escapeHtml(strategy)}" data-selector="${escapeHtml(selector)}">Test</button>
           </div>
         `

Source: GitHub Commit e222bbb

Detection Methods for CVE-2026-58500

Indicators of Compromise

MCP UI resources returned by generate_locators containing <script>, <img onerror=...>, or event-handler attributes inside element text or resource IDs.
window.parent.postMessage calls originating from a rendered MCP UI resource that invoke tools the user did not request.
Unexpected MCP tool activity such as screenshot captures or page-source reads immediately after a generate_locators invocation.

Detection Strategies

Inspect the appium-mcp package version in mobile testing environments and flag any release below 1.85.10.
Log and review outbound MCP tool calls per session; correlate calls that occur after generate_locators output is rendered.
Scan cached MCP UI resources for HTML metacharacters in fields sourced from text, content-desc, resource-id, or locator selectors.

Monitoring Recommendations

Monitor MCP client telemetry for postMessage events triggering tool invocations outside the assistant's intended workflow.
Alert on installations of appium-mcp versions below 1.85.10 across CI/CD runners and developer workstations.
Track process activity of Appium test runs that interact with untrusted or third-party mobile applications.

How to Mitigate CVE-2026-58500

Immediate Actions Required

Upgrade appium-mcp to version 1.85.10 or later across all MCP servers, CI runners, and developer environments.
Restrict generate_locators usage to trusted apps under test until upgrades are complete.
Review MCP client permissions and reduce the set of tools automatically callable from rendered UI resources.

Patch Information

The fix landed in commit e222bbb and adds escapeHtml around every interpolated element attribute in createLocatorGeneratorUI. The inline onclick handler was also removed in favor of data-* attributes, eliminating the JavaScript-context injection path. Refer to the GitHub Security Advisory GHSA-x975-rgx4-5fh4 and the patch commit.

Workarounds

Avoid rendering MCP UI resources from generate_locators when testing untrusted applications.
Configure the MCP client to sandbox rendered UI resources and block postMessage-initiated tool calls.
Sanitize element attributes at the MCP client layer before rendering if immediate upgrade is not possible.

bash

# Upgrade appium-mcp to the patched release
npm install appium-mcp@1.85.10

# Verify the installed version
npm ls appium-mcp