The createLocatorGeneratorUI endpoint in MCP Appium interpolates user‑controlled element attributes—text, content‑desc, resource‑id, and locator selector values—directly into an HTML template literal without any escaping. This yields a reflected cross‑site scripting flaw in the MCP‑UI resource generated by the generate_locators tool. When an attacker who controls the UI of the application under test supplies crafted attribute values, malicious HTML and JavaScript are embedded into the resource. When a victim’s MCP client renders this resource, the injected script executes in the client’s context and can use window.parent.postMessage to invoke any registered MCP tool, such as taking screenshots, retrieving page source, or executing other capabilities. The impact is the ability to run arbitrary MCP commands as the client, potentially exposing sensitive test data.

The vulnerability affects the Appium appium-mcp server running any version prior to 1.85.10. This includes installations used for Android or iOS testing. The flaw resides in the createLocatorGeneratorUI function across all affected releases and is fixed in version 1.85.10 and later.

The CVSS score of 8.2 reflects a high‑severity scenario. The EPSS score is less than 1 %, indicating a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can control the UI of an app under test and supply malicious locator attributes. Practical exploitation also requires a victim MCP client to render the unsanitized UI resource. Consequently, the theoretical risk is significant but real‑world exploitation requires specific conditions in the testing workflow.