MEDIUM 6.5 GitHub
CVE-2026-58191
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
## Summary
Appium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea-pig-app-banner` routes **unconditionally** on every server. The handler reflects the `throwError` query param, the `comments` POST field, and the `User-Agent` request header into the returned HTML via `compileLodashTemplate`, which interpolates `<%= expr %>` as `String(expr)` with **no HTML/JS escaping**. This yields reflected XSS, and the `throwError` value is reflected **ins
Affected Products
- npm/@appium/base-driver <= 10.6.0
References
- https://github.com/advisories/GHSA-3wgp-x9p5-c7cc
- https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc
- https://nvd.nist.gov/vuln/detail/CVE-2026-58191
- https://github.com/appium/appium/pull/22394
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-01 via GitHub. Affected: npm/@appium/base-driver <= 10.6.0.
vulnfeed aggregates 11520 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.