GHSA-g4c9-f287-64xg
SimStudioAI: A function in route.ts is vulnerable to Code Injection
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability was identified in SimStudioAI sim. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-10097
- https://github.com/simstudioai/sim/issues/961
- https://github.com/simstudioai/sim/issues/961#issuecomment-3215578979
- https://github.com/simstudioai/sim/pull/1149/commits/3f790867427275ebae3b3dc75cf1d93d912ac9ca
- https://github.com/simstudioai/sim
- https://vuldb.com/?ctiid.323058
- https://vuldb.com/?id.323058
- https://vuldb.com/?submit.644954