Description
A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SimStudioAI | sim | 1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | simstudio | <= 0.1.19 | — | GHSA-g4c9-f287-64xg |
References
- VDB-323058 | SimStudioAI sim route.ts code injection vdb-entry technical-description
- VDB-323058 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #644954 | simstudioai https://github.com/simstudioai/sim <=1.0.0 Remote Code Execution third-party-advisory
- https://github.com/simstudioai/sim/issues/961 issue-tracking
- https://github.com/simstudioai/sim/issues/961#issuecomment-3215578979 issue-tracking