VulnSocial

CVE-2026-58191Disclosure(appium / appium\/base-driver)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.

appium CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-79CWE-489

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • appium\/base-driver

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
appium
Products
appium\/base-driver

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-01: 1Mentions · 2026-09-14: 1Technical Details · 2026-09-01: 1Technical Details · 2026-09-14: 109-0109-14
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-58191 - medium 🚨 Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting > Appium <= 10.7.0 contains a reflected XSS caused by unescaped reflection of throwErro... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-58191 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet discloses CVE‑2026‑58191 as a medium‑severity reflected XSS affecting Appium base‑driver versions ≤10.6.0/≤10.7.0, providing a link to a library and Nuclei templates but no PoC, exploit, patch, or evidence of active exploitation.

    00060396
    1.3K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Appium base-driver, Reflected Cross-Site Scripting (XSS), #CVE-2026-58191 (Critical) -DC-Sep2026-2062 https://dailycve.com/appium-base-driver-reflected-cross-site-scripting-xss-cve-2026-58191-critical-dc-sep2026-2062/

    Post summary

    A critical Appium base-driver vulnerability (CVE-2026-58191) involving reflected XSS has been disclosed.

    0000042
    232 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appappiumappium\/base-driver-node.js-

Explore more

Back to dashboardappium CVEsappium\/base-driver vulnerabilities