Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@appium/base-driver

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5npmPublished

    Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

    CVE-2026-58191 · GHSA-3wgp-x9p5-c7cc

    Affected
    • npm @appium/base-driver <= 10.6.0
    Fixed in
    10.7.0· Vendor fix available
    Issue
    Appium's base-driver mounts the built-in /test/guinea-pig, /test/guinea-pig-scrollable and /test/guinea-pig-app-banner routes unconditionally on every server. The handler reflects the throwError query param, the comments POST field, and the User-Agent request header into the returned HTML via compileLodashTemplate, which interpolates <%= expr % as String(expr) with no HTML/JS escaping. This yields reflected XSS, and the throwError value is reflected inside a <script block, giving arbitrary JavaScript execution on the server's origin. No authentication, no session, no driver and no plugin are required, and the default bind address is 0.0.0.0. Details Affected - @appium/base-driver 10.6.0 (with Appium server 3.5.0); tested live. - Template engine helper: @appium/base-driver lib/utils.ts compileLodashTemplate. Location (file:line) - Routes mounted unconditionally: base-driver/lib/express/server.ts:216-219 (app.all('/test/guinea-pig', guineaPig) etc.). - Tainting:…

    Recommended action: Upgrade to 10.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →