Vulnerabilities

Appium Java Client from version 8.2.1 until 10.1.1 contains a flaw in the optional directConnect feature: when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() rebuilds the server URL from the directConnectHost, directConnectPort, and directConnectPath values returned in the Appium server's NEW_SESSION response, validating only that the protocol is https with no host allowlist or IP validation. A rogue or compromised Appium server, or anything able to tamper with that response, can therefore point the client at an arbitrary destination, and all subsequent traffic for that test session is redirected there. An attacker gains full interception of the redirected session traffic and can use the client as a server-side request forgery pivot to reach internal services from the test machine's network position, including cloud instance metadata (IMDS) endpoints for credential theft. Exposure is limited to teams running tests with the affected Java client versions and directConnect enabled; Appium servers and other language bindings are not the vulnerable component. No in-the-wild exploitation is reported; the flaw is documented in a public GitHub advisory, EPSS estimates only a 0.3% chance of exploitation within 30 days, and it is not in CISA KEV.

Do: Upgrade Appium Java Client to 10.1.1 or later. Until patched, avoid enabling directConnect(true) or verify that directConnect host/port/path values returned by your Appium server/grid are from a trusted allowlist, since any rogue or compromised server can hijack session traffic. Review the network position of test/CI machines for SSRF pivot risk, especially cloud instances where metadata (IMDS) credential theft is possible.

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc, resource-id, and locator selector values — directly into an HTML template literal without any HTML or JavaScript context escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the generate_locators tool. When a victim's MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via window.parent.postMessage, leading to unauthorized MCP tool execution such as taking screenshots, reading page source, or any other registered capability. This issue has been fixed in version 1.85.10.

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate reflects the throwError query parameter, comments POST field, and User-Agent request header into HTML without escaping, allowing reflected cross-site scripting and arbitrary JavaScript execution on the server origin. This issue is fixed in version 10.7.0.

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. This vulnerability is fixed in 7.0.6.

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.