What is the CVSS score of CVE-2026-58500?

CVE-2026-58500 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of appium-mcp are affected by CVE-2026-58500?

Appium-mcp testing server (versions through 1.85.9) contains an XSS vulnerability allowing malicious mobile applications to commandeer the testing infrastructure and exfiltrate test data and…. A patch is available.

How to fix or mitigate CVE-2026-58500?

Within 24 hours, inventory all systems running appium-mcp versions 1.85.9 or earlier in your QA and test automation infrastructure. Within 7 days, deploy patch version 1.85.10 to all affected instances across development and testing environments. By day 30, audit testing logs for the vulnerability window to identify any unauthorized MCP tool invocations, and implement network segmentation to isolate testing infrastructure from production and sensitive applications.

appium-mcp CVE-2026-58500

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 GitHub_M

XSS Google Appium Mcp Appium

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

Remote unauthenticated injection but victim must render the resource (UI:R); script crosses into the MCP client to run tools (S:C), yielding high integrity and low confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 21:47 vuln.today

Analysis Generated

Jul 13, 2026 - 21:47 vuln.today

CVE Published

Jul 13, 2026 - 21:17 cve.org

HIGH 8.2

DescriptionCVE.org

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes - text, content-desc, resource-id, and locator selector values - directly into an HTML template literal without any HTML or JavaScript context escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the generate_locators tool. When a victim's MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via window.parent.postMessage, leading to unauthorized MCP tool execution such as taking screenshots, reading page source, or any other registered capability. This issue has been fixed in version 1.85.10.

AnalysisAI

Cross-site scripting in appium-mcp (the Appium MCP server) versions <= 1.85.9 lets an attacker who controls the mobile app under test inject arbitrary HTML/JavaScript into the MCP UI resource returned by the generate_locators tool, because createLocatorGeneratorUI interpolates element attributes (text, content-desc, resource-id, selector, strategy) into an HTML template without escaping. When a victim's MCP client renders the resource, the injected script runs and can call arbitrary registered MCP tools via window.parent.postMessage (screenshots, page-source reads, etc.). No public exploit identified at time of analysis, though the fix commit ships XSS test cases; fixed in 1.85.10.

Technical ContextAI

appium-mcp is a Node/TypeScript MCP (Model Context Protocol) server that exposes Appium mobile-automation capabilities as tools to AI assistants. The root cause is CWE-79 (improper neutralization of input during web page generation): in src/ui/mcp-ui-utils.ts (~lines 720-740) the createLocatorGeneratorUI function builds an HTML template literal, embedding element.text, element.contentDesc, element.resourceId, selector and strategy directly, and additionally embeds selector/strategy into an inline onclick JavaScript string using only a backtick escape that is insufficient against HTML event-attribute or single-quote breakout. The data flows from an attacker-controlled Appium session: getPageSource(driver) (locators.ts:57) reads the app's page-source XML, which is parsed in source-parsing.ts with only newline normalization, then rendered without HTML-context escaping. The sibling function createPageSourceInspectorUI already escapes its output, confirming the gap is an oversight. MCP UI resources are HTML rendered in the client and can message the parent frame, so injected script can drive the MCP tool bus.

RemediationAI

Vendor-released patch: upgrade appium-mcp to 1.85.10 or later, which HTML-escapes tagName, text, contentDesc, resourceId, selector and strategy via a new escapeHtml() helper and replaces the inline onclick handler with data-strategy/data-selector attributes plus a delegated click listener (see commit e222bbbd6fe2b656a320efcd143563f08061a83d and advisory GHSA-x975-rgx4-5fh4). If you cannot upgrade immediately, only run generate_locators against trusted apps whose UI content you control, since the exploit requires attacker-controlled element attributes in the app under test; avoid pointing the server at untrusted or third-party apps. As an additional control, harden or sandbox the MCP client's rendering of UI resources and restrict which MCP tools can be invoked via window.parent.postMessage so that a rogue resource cannot trigger sensitive capabilities - noting this reduces functionality of legitimate interactive UI resources.