CVE-2026-84887
MediumCVSS 4.3Summary
Vulnerability in simular-ai Agent-S up to 0.3.2, affecting unknown functionality in grounding.py of the Model-generated GUI Action Execution Workflow component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
A remote attack could cause service unavailability, potentially disrupting applications relying on Agent-S.
Recommendation
Update Agent-S to a version newer than 0.3.2 if available, or apply other mitigations.
Other vulnerabilities in simular-ai Agent-S
See all- CVE-2026-84886Medium
Vulnerability in simular-ai Agent-S up to 0.3.2, affecting the ImageData function in gui_agents/s1/utils/ocr_server.py of the OCR HTTP API component. Manipulating the img_bytes argument leads to resource consumption. The attack can be launched remotely, and the exploit is publicly disclosed.
- CVE-2026-84885Medium
Vulnerability in simular-ai Agent-S versions 0.3.1 and 0.3.2, affecting an unknown function in code_agent.py of the CodeAgent component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.