TI-2026-74357 CVE-2026-103975 · GHSA-qfxx-c367-67f8
Symlink-based zip slip in Appium ZIP extraction
Priority MEDIUM 62
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.
Vulnerabilities
8 records
TI-2026-31973 CVE-2026-43910 · GHSA-28f5-38xr-jh2w
Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Priority HIGH 69
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol.
TI-2026-42099 CVE-2026-58500
MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
Priority HIGH 69
MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS.
TI-2026-41908 CVE-2026-58191 · GHSA-3wgp-x9p5-c7cc
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Priority LOW 30
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.
TI-2026-41909 CVE-2026-58192
Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
Priority HIGH 82
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.
TI-2026-23797 CVE-2026-30973 · GHSA-rfx7-4xw3-gh4m
Zip Slip arbitrary file write in @appium/support ZIP extraction
Priority MEDIUM 62
Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms.
TI-2023-02328 CVE-2023-2479 · GHSA-xq6j-x8pq-g3gr
OS Command Injection in appium/appium-desktop
Priority HIGH 82
OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
TI-2016-08598 CVE-2016-10557 · GHSA-hc94-2wfr-4pwf
Cryptographic flaw in HackerOne appium-chromedriver node module
Priority LOW 37
appium-chromedriver is a Node.js wrapper around Chromedriver.