CVE-2025-10097
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
Risk Assessment
A remote attacker can inject and execute arbitrary code, potentially leading to system compromise. Organizations using SimStudioAI sim are at risk of a serious security breach.
Recommendation
Update SimStudioAI sim to a version newer than 1.0.0 if available, or apply mitigations such as input validation.
Other vulnerabilities in SimStudioAI sim
See all- CVE-2026-13510Low
A vulnerability was found in SimStudioAI sim up to version 0.6.92 in the password protection handler component (apps/sim/lib/core/security/deployment.ts). Manipulation leads to use of a weak hash, enabling a remote attack with high complexity. The exploit has been made public and a fix is pending.
- CVE-2025-9800Medium
A vulnerability was identified in SimStudioAI sim up to commit ed9b9ad83f1a7c61f4392787fb51837d34eeb0af, specifically in the Import function of the file apps/sim/app/api/files/upload/route.ts (HTML File Parser component). Manipulation of the File argument can lead to unrestricted upload. The attack may be launched remotely, and the exploit is publicly available. The product operates on a rolling release basis, so no version details are available. The patch is identified as 45372aece5e05e04b417442417416a52e90ba174.
Original NVD description (English source)
A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS