Executive brief
Appium MCP is a tool used by developers to automate and inspect mobile applications. A security flaw allows an attacker to create a malicious mobile app that, when inspected by a developer using this tool, executes unauthorized commands on the developer's machine. This could lead to the theft of sensitive data, such as screenshots and source code, or allow the attacker to perform actions on the developer's behalf.
Technical details
A stored/reflected Cross-Site Scripting (XSS) vulnerability exists in the `createLocatorGeneratorUI` function of `appium-mcp`. The root cause is the direct interpolation of attacker-controlled element attributes (such as `text`, `content-desc`, and `resource-id`) into HTML template literals without proper escaping. An attacker can craft a mobile application with malicious XML attributes that, when parsed by the `generate_locators` tool and rendered in an MCP client's WebView or iframe, executes arbitrary JavaScript. This script can then use `window.parent.postMessage` to invoke any registered MCP tools, such as `appium_screenshot` or `execute_script`, potentially leading to data exfiltration or further compromise of the developer's environment. The issue is fixed in version 1.85.10.
Affected products
- Appium appium-mcp <= 1.85.9
Timeline
- 2026-06-19: advisory: GitHub Advisory GHSA-x975-rgx4-5fh4 published.
- 2026-06-19: patched: Version 1.85.10 released to address the vulnerability.