CVE-2026-58191
MediumPrior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML…
Published Jul 8, 2026 · Updated Sep 1, 2026 · Also known as EUVD-2026-42425, GHSA-3wgp-x9p5-c7cc
Key Facts
Routine patching- CVE-2026-58191 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Appium\/base-Driver, @appium/base-driver (npm), appium.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including @appium/base-driver 10.7.0, appium 10.7.0, Appium\/base-Driver 10.7.0.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
0.6%
Higher than 45.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-58191 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Appium\/base-DriverAppium | See advisory | 10.7.0 |
| @appium/base-drivernpm | See advisory | 10.7.0 |
| appium | See advisory | 10.7.0 |
Patched Releases
@appium/base-driver
10.7.0
appium
10.7.0
Appium\/base-Driver
10.7.0
Timeline
Publicly disclosed
Jul 8, 2026
Last updated
Sep 1, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-489 Active Debug Code
References
- advisoryGHSA advisory
- advisoryhttps://github.com/appium/appium/commit/d94a40af9f8040191ee7888571a1c9d5aec59f89
- advisoryhttps://github.com/appium/appium/pull/22394
- advisoryhttps://github.com/appium/appium/releases/tag/@appium/base-driver@10.7.0
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58191.json
FAQ
Common Questions.
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.
Affected: Appium\/base-Driver; @appium/base-driver (npm); appium. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including @appium/base-driver 10.7.0, appium 10.7.0, Appium\/base-Driver 10.7.0.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-58191 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo