SimStudioAI sim vulnerabilities

A vulnerability was found in SimStudioAI sim up to version 0.6.92 in the password protection handler component (apps/sim/lib/core/security/deployment.ts). Manipulation leads to use of a weak hash, enabling a remote attack with high complexity. The exploit has been made public and a fix is pending.

A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.

A vulnerability was identified in SimStudioAI sim up to commit ed9b9ad83f1a7c61f4392787fb51837d34eeb0af, specifically in the Import function of the file apps/sim/app/api/files/upload/route.ts (HTML File Parser component). Manipulation of the File argument can lead to unrestricted upload. The attack may be launched remotely, and the exploit is publicly available. The product operates on a rolling release basis, so no version details are available. The patch is identified as 45372aece5e05e04b417442417416a52e90ba174.