Detections
Analytics
SCA: security update for @appium/support (GHSA-qfxx-c367-67f8)
medium Tenable Cloud Security Plugin ID 474704
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver
protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic
link to a location outside the extraction directory and then accepts a later regular-file entry whose
legitimate name resolves through that link. The lexical containment check examines entry names without
validating the symlink target or the real destination, so an attacker-controlled archive can write files
to arbitrary locations writable by the Appium process. This is distinct from the earlier parent-directory
entry-name traversal fixed in 7.0.6 because the bypass uses no parent-directory or absolute entry name.
Depending on the writable destination, the arbitrary file write can overwrite configuration, startup
scripts, or executables and lead to code execution. This issue is fixed in version 7.2.6.
(CVE-2026-103975)
Solution
Update the @appium/support library and its related packages to version 7.2.6 or later.See Also
Plugin Details
Severity: Medium
ID: 474704
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/16/2026
Updated: 10/16/2026
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.67
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2026-103975
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/15/2026
Vulnerability Publication Date: 10/14/2026
Reference Information
CVE: CVE-2026-103975
cwe: CWE-59