Executive brief
Appium's base-driver component exposes debug/test endpoints that unconditionally serve user-supplied data (query parameters, POST fields, request headers) without HTML escaping, allowing attackers to inject and execute arbitrary JavaScript in a victim's browser. An attacker can trick a user into visiting a malicious link to the Appium server, then leverage the injected code to control WebDriver APIs and manipulate browser automation—especially problematic since these endpoints should never be public-facing.
Technical details
The vulnerability is a reflected XSS in Appium's base-driver template rendering. The guineaPigTemplate handler in base-driver/lib/express/static.ts takes user input from the throwError query parameter, comments POST field, and User-Agent header and passes it to compileLodashTemplate in lib/utils.ts. The template engine uses Lodash template syntax (<%= expr %>) and renders it via new Function(...) without HTML or JavaScript escaping. This allows attackers to inject arbitrary expressions; when throwError is reflected inside a <script> block, they achieve direct JavaScript execution. The vulnerability requires user interaction (victim must open a crafted link or auto-submitted form) and targets the server origin with default CORS policy (*), enabling control of WebDriver REST API endpoints and plugins. No authentication or session is required, and the default bind address is 0.0.0.0.
Affected products
- Appium @appium/base-driver <= 10.6.0
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched: Patched in version 10.7.0
- 2026-09-01: advisory
References
- https://api.github.com/users/nikkoenggaliano
- https://github.com/nikkoenggaliano
- https://api.github.com/users/nikkoenggaliano/gists%7B/gist_id%7D
- https://api.github.com/users/nikkoenggaliano/repos
- https://avatars.githubusercontent.com/u/37658579?v=4
- https://api.github.com/users/nikkoenggaliano/events%7B/privacy%7D