1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
appium-base-driver
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting appium-base-driver, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3wgp-x9p5-c7cc | Moderate | Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes## Summary Appium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea-pig-app-banner` routes **unconditionally** on every server. The handler reflects the `throwError` query param, the `comments` POST field, and the `User-Agent` request header into the returned HTML via `compileLodashTemplate`, which interpolates `<%= expr %>` as `String(expr)` with **no HTML/JS escaping**. This yields reflected XSS, and the `throwError` value is reflected **inside a `<script>` block**, giving arbitrary JavaScript execution on the server's origin. No authentic |
| GitHub (opens in a new tab) |
- GHSA-3wgp-x9p5-c7ccModerateAppium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
< 10.7.0
## Summary Appium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea-pig-app-banner` routes **unconditionally** on every server. The handler reflects the `throwError` query param, the `comments` POST field, and the `User-Agent` request header into the returned HTML via `compileLodashTemplate`, which interpolates `<%= expr %>` as `String(expr)` with **no HTML/JS escaping**. This yields reflected XSS, and the `throwError` value is reflected **inside a `<script>` block**, giving arbitrary JavaScript execution on the server's origin. No authentic
CVE: CVE-2026-58191