Appium base-driver, Reflected Cross-Site Scripting (XSS), CVE-2026-58191 (Critical) -DC-Sep2026-2062

Appium is a cross-platform automation framework built on top of the W3C WebDriver protocol. Prior to version 10.7.0, a critical vulnerability existed in its `@appium/base-driver` component.
The core of the issue lies in several built-in test routes (/test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner) which are mounted unconditionally on every server instance. No authentication, session, driver, plugin, or specific configuration is required to access them.
The vulnerability is triggered when the handler for these routes processes user-supplied input from three specific sources: the `throwError` query parameter, the `comments` field in a POST request body, and the `User-Agent` request header. This input is then passed to the `compileLodashTemplate` function, which interpolates values using the Lodash template syntax (<%= expr %>).
Critically, the `compileLodashTemplate` function renders this input as `String(${expr})` via `new Function(…)` without any HTML or JavaScript escaping. This allows an attacker to inject malicious code. The most dangerous vector is the `throwError` parameter, as its value is reflected directly inside a `

Listen to this Post