CyberRota Analysis
AI-GeneratedThe vulnerability affects the Appium automation framework prior to version 10.7.0, where unescaped user input in specific routes can lead to reflected cross-site scripting (XSS) and arbitrary JavaScript execution on the server. This poses a risk to applications that utilize Appium for testing, as it could allow attackers to execute malicious scripts in the context of the affected server. Organizations using Appium for automated testing should prioritize updating to version 10.7.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)