In appium-mcp versions before 1.85.10, the createLocatorGeneratorUI function fails to properly neutralize input when generating web page content, leading to a cross-site scripting (CWE-79) vulnerability. Specifically, attacker-controlled attributes (text, content-desc, resource-id, locator selector values) are embedded directly into an HTML template literal without HTML or JavaScript context escaping. This enables an attacker who controls the UI of the app under test to inject arbitrary HTML/JavaScript into the MCP UI resource returned by the generate_locators tool. When a victim's MCP client renders this resource, the injected script executes and can invoke MCP tools via window.parent.postMessage, resulting in unauthorized execution of MCP capabilities such as taking screenshots or reading page source. The vulnerability has a CVSS 3.1 score of 8.2 (high severity) and was fixed in version 1.85.10.

An attacker controlling the UI of the app under test can exploit this vulnerability to inject malicious scripts into the MCP UI resource. This leads to unauthorized execution of MCP tools on the victim's client, including sensitive operations like taking screenshots and reading page source. The vulnerability compromises confidentiality and integrity of the MCP environment but does not impact availability.

This vulnerability is fixed in appium-mcp version 1.85.10. Users should upgrade to version 1.85.10 or later to remediate this issue. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the fix in 1.85.10.