Appium vulnerabilities
We track 3 vulnerabilities in Appium products across 4 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.
Latest Appium vulnerabilities
- 8.2 High severity
java-client: Unintended Proxy or Intermediary
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConne
- 8.2 High severity
appium-mcp: Improper Neutralization of Input During Web Page Generation
MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc,
- 10.0 Critical severity
appium: Improper Limitation of a Pathname to a Restricted Directory
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join