CVE-2026-58191

Appium includes test pages that can mistakenly treat information from a web request as trusted content. It is like leaving a message board at the office reception desk where a visitor can post instructions that appear to come from your business.

This matters to you if you run Appium for mobile or web application testing. The attacker does not need their own login, but a person must open a malicious link; the risk is greatest when the Appium server is reachable by people who could receive one.

An attacker must persuade someone to open a crafted link, which limits immediate exposure. There is no confirmed active exploitation and it is not listed in CISA’s known-exploited catalog, but update on a planned near-term maintenance window and restrict the affected test routes in the meantime.

Confirm the installed dependency with npm ls @appium/base-driver and identify whether the Appium service exposes the three /test/guinea-pig* routes to browsers outside a trusted testing network. Upgrade the affected dependency to 10.7.0 or a later compatible release; the available findings provide no separate fixed-version branches or breaking-change notice. If the upgrade must wait, deny the three test-route paths at a reverse proxy or firewall and limit Appium access to trusted staff and test systems. Review web or proxy logs for requests to these paths, especially requests using throwError, submitted comments, or unusual User-Agent values. CISA has not assigned a KEV due date because this CVE is not listed in KEV.

CVE-2026-58191 is rated CVSS 6.5 (Medium): network attack vector, low complexity, no privileges required, user interaction required, integrity impact high. The issue is CWE-79 reflected XSS, with CWE-489 also identified, in test routes that are mounted unconditionally before @appium/base-driver 10.7.0. Request-controlled throwError, POST comments, and User-Agent values can be reflected into HTML without escaping, enabling JavaScript execution in the Appium server origin. No known public weaponized exploit is identified beyond a detection template; CISA KEV does not list the vulnerability. EPSS predicts 0.4% likelihood and is flat (38th percentile); this is a prediction, not evidence of exploitation. Press attention is rising.