CVE-2026-58191

6.1 Moyenne

Publiée le 08/07/2026 à 23:16 · Modifiée le 15/07/2026 à 22:31 · Analysée par le NVD · Source : security-advisories@github.com

Description

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
3.1	6.1 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

Références

https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc ExploitVendor Advisory

CVE-2026-58191

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs