SimStudioAI: A function in route.ts is vulnerable to Code Injection

CRITICAL 9.8CVE-2025-10097 · GHSA-g4c9-f287-64xg · Published 08/09/2025 · updated 30/09/2026

Package	Affected versions	Patched versions
sim sim	`= 1.0.0`	No fix yet
simstudio npm	`≤ 0.1.19`	No fix yet

Description

A vulnerability was identified in SimStudioAI sim. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.

NVD description

A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.

References

nvd.nist.gov/vuln/detail/CVE-2025-10097 · ADVISORY
simstudioai/sim · WEB
simstudioai/sim · WEB
simstudioai/sim#1149 · WEB
simstudioai/sim · PACKAGE
vuldb.com · WEB
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free