appium vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20265

Newest CVEs

• CVE-2026-103975

  Appium: Symlink based Zip Slip in @appium/support ZIP extraction

  appium · appium

  Medium6.5
• CVE-2026-43910

  Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

  appium · java-client

  High8.2
• CVE-2026-58500

  MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

  appium · appium-mcp

  High8.2
• CVE-2026-58191

  Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

  appium · appium

  Medium6.5
• CVE-2026-58192

  Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

  appium · appium

  High8.6
• CVE-2023-2479

  OS Command Injection in appium/appium-desktop

  appium · appium/appium-desktop

  Critical9.8