appium

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

appium records in CISA KEV

No appium vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Appium-chromedriver 1 record LOW Appium-desktop 1 record HIGH Appium-mcp 1 record HIGH Appium/base-driver 1 record LOW Appium/storage-plugin 1 record HIGH Appium/support 1 record MEDIUM Java-client 1 record HIGH

Records

8 records

TI-2026-41909 CVE-2026-58192

Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

HIGH 82

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00636 Published 2026-07-08 Fixed in 1.1.6 CWE-22

TI-2023-02328 CVE-2023-2479 · GHSA-xq6j-x8pq-g3gr

OS Command Injection in appium/appium-desktop

HIGH 82

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.22014 Published 2023-05-02 Fixed in v1.22.3-4 CWE-78

TI-2026-42099 CVE-2026-58500

MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

HIGH 69

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.004 Published 2026-07-13 Fixed in 1.85.10 CWE-79

TI-2026-31973 CVE-2026-43910 · GHSA-28f5-38xr-jh2w

Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

HIGH 69

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.0043 Published 2026-07-28 Fixed in 10.1.1 CWE-441

TI-2026-74357 CVE-2026-103975 · GHSA-qfxx-c367-67f8

Symlink-based zip slip in Appium ZIP extraction

MEDIUM 62

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0064 Published 2026-10-14 Fixed in 7.2.6 CWE-59

TI-2026-23797 CVE-2026-30973 · GHSA-rfx7-4xw3-gh4m

Zip Slip arbitrary file write in @appium/support ZIP extraction

MEDIUM 62

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0048 Published 2026-03-10 Fixed in 7.0.6 CWE-22

TI-2016-08598 CVE-2016-10557 · GHSA-hc94-2wfr-4pwf

Cryptographic flaw in HackerOne appium-chromedriver node module

LOW 37

appium-chromedriver is a Node.js wrapper around Chromedriver.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01097 Published 2018-05-31 Fixed in 2.9.4 CWE-311

TI-2026-41908 CVE-2026-58191 · GHSA-3wgp-x9p5-c7cc

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

LOW 30

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00564 Published 2026-07-08 Fixed in 10.7.0 CWE-489

Open these records in search →

Critical	2
High	3
Medium	3
Low	0
No CVSS	0