MCP Appium Stored XSS Leading to Cross-Boundary MCP Tool Invocation

Technical Analysis

The createLocatorGeneratorUI function interpolates untrusted values (text, content-desc, resource-id, locator selectors) directly into an HTML template literal without HTML/JS escaping, creating a classic stored/reflected XSS vector. The entry point is the mobile application being tested, which fully controls its own UI attributes and can craft malicious element metadata that Appium retrieves and forwards to the MCP server. Once the MCP client renders the generated UI resource, the injected script runs in the client's privileged context and can call window.parent.postMessage to invoke any MCP tool the client has registered, crossing the trust boundary between 'test subject' and 'test operator'. This grants the attacker capabilities such as taking screenshots, reading page source, or triggering other registered MCP tools without any additional authentication, turning a benign automation surface into a tool-execution pivot.

Affected Systems

MCP Appium; protocols: MCP

Detection Signatures

• Unescaped HTML special characters (<, >, ", ', &) present in element text/content-desc/resource-id attributes ingested from mobile apps
• MCP UI resources from generate_locators tool containing <script> tags or inline event handlers (onerror=, onload=, onclick=)
• Unexpected postMessage calls targeting window.parent from rendered MCP UI resources
• MCP tool invocations immediately following rendering of generate_locators output with no corresponding user action
• Log entries showing generate_locators output size or content anomalies compared to expected locator JSON/HTML structure

Remediation Steps

1. 1

   Upgrade MCP Appium

   Update to version 1.85.10 or later, which fixes the HTML/JS escaping issue in createLocatorGeneratorUI.

2. 2

   Sanitize and encode untrusted attributes

   Ensure all app-derived attributes (text, content-desc, resource-id, selectors) are HTML/JS-context escaped before being embedded into any UI templates rendered by MCP clients.

3. 3

   Restrict postMessage tool invocation

   Enforce origin checks and explicit allowlisting for postMessage-based tool invocation so rendered UI resources cannot arbitrarily trigger MCP tools.

4. 4

   Sandbox rendering of MCP UI resources

   Render generate_locators output in a sandboxed iframe with restricted script execution and no direct access to the parent MCP client's tool-calling interface.

5. 5

   Test with untrusted/adversarial apps

   Include adversarial mobile app fixtures with malicious element attributes in CI/CD testing of MCP Appium integrations to catch injection regressions.