CVE-2026-58191

mediumCVSS 6.5covered by 1 sourcefirst seen 2026-07-08

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.

⚡ Watch CVE-2026-58191

Get an email if CVE-2026-58191 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-58191: Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C…nvd · 2026-07-08

External references

NVD record for CVE-2026-58191

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-58191 status](https://www.csirts.com/badge/CVE-2026-58191)](https://www.csirts.com/cve/CVE-2026-58191)