Skip to content
OpenAdvisories

Vendor

appium

7 known vulnerabilities.

Products

appium 3 support 1 java-client 1 appium-mcp 1 appium/appium-desktop 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-43910

    Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

    Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConn…

    appium java-client io.appium:java-client Maven
  • High 8.2
    CVE-2026-58500

    MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

    MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc,…

    appium appium-mcp appium-mcp npm
  • High 8.6
    CVE-2026-58192

    Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

    Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joi…

    appium appium