CVE-2026-58191
Last modified
CVE-2026-58191 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Appium | Appium\/Base-Driver | < 10.7.0 |
References
- https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7ccExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-58191?
How severe is CVE-2026-58191?
How do I fix CVE-2026-58191?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-58184The Apache Traffic Server header_rewrite plugin can crash or…7.5
- CVE-2026-58185The Apache Traffic Server intercept plugin has a use-after-f…9.8
- CVE-2026-58186The Apache Traffic Server webp_transform plugin can decode u…8.2
- CVE-2026-58187The Apache Traffic Server multiplexer plugin overruns its ch…7.5
- CVE-2026-58188Several Apache Traffic Server experimental plugins have memo…8.4
- CVE-2026-58189Apache Traffic Server allows redirect-limit bypass when plug…8.2
- CVE-2026-58192Appium is a cross-platform automation framework for all kind…8.6
- CVE-2026-58195Agentic-Flow is an AI agent orchestration platform. Prior to…8.8
- CVE-2026-58198ChatterBot is a machine learning, conversational dialog engi…5.5
- CVE-2026-5820The Zypento Blocks plugin for WordPress is vulnerable to Sto…6.4
- CVE-2026-58203pydantic-settings provides settings management using Pydanti…5.3
- CVE-2026-58207NATS Server is a high-performance server for NATS.io, the cl…6.5
Are you affected by CVE-2026-58191?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST