EUVD-2026-42425
GHSA-3wgp-x9p5-c7cc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible routes, no attacker auth needed (PR:N), but victim must visit URL (UI:R); C:L added because XSS enables cookie and session token theft beyond integrity-only impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 npm packages depend on @appium/base-driver (2 direct, 1 indirect)
Ecosystem-wide dependent count for version 10.7.0.
DescriptionNVD
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
AnalysisAI
Reflected cross-site scripting in Appium's base-driver allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser on the Appium server origin. All Appium installations prior to 10.7.0 unconditionally expose three test routes whose compileLodashTemplate handler reflects unsanitized user-controlled inputs - the throwError query parameter, the comments POST field, and the User-Agent request header - directly into rendered HTML without output encoding. No public exploit has been identified at time of analysis, but the zero-authentication requirement and permanently-mounted test routes make any network-reachable Appium server an attack surface with no opt-out mechanism below the fix version.
Technical ContextAI
Appium is a W3C WebDriver-based automation framework for mobile and desktop applications, primarily used in CI/QA pipelines. Its base-driver component registers three unconditional HTTP routes - /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner - that render HTML pages using Lodash template compilation via compileLodashTemplate. The root cause (CWE-79, Improper Neutralization of Input During Web Page Generation) is the absence of HTML entity encoding before interpolating user-supplied values into the template output. Because these routes are hardcoded into the base-driver and cannot be disabled through configuration, every Appium instance prior to 10.7.0 exposes this attack surface regardless of deployment intent. Affected versions are confirmed as appium < 10.7.0 per EUVD-2026-42425.
RemediationAI
Upgrade Appium to version 10.7.0 or later, which removes or properly escapes the reflected inputs in the affected test route handlers; this is the primary and confirmed fix per vendor advisory GHSA-3wgp-x9p5-c7cc at https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc. If immediate upgrade is not feasible, restrict Appium's network binding to localhost (127.0.0.1) only - preventing remote access eliminates the network attack vector entirely, though this may break remote device farm configurations. Alternatively, deploy a reverse proxy or host-based firewall rule blocking external access to the Appium port (default 4723) from untrusted networks; note this requires firewall management overhead and does not fix the underlying flaw. There is no known configuration flag to disable the vulnerable test routes without patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today