medium6.3
CVE-2025-10097
SimStudioAI: A function in route.ts is vulnerable to Code Injection
Impact
A vulnerability was identified in SimStudioAI sim. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | simstudio | <= 0.1.19 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sim | Sim | Version 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/simstudioai/sim/issues/961
- https://github.com/simstudioai/sim/issues/961#issuecomment-3215578979
- https://vuldb.com/?ctiid.323058
- https://vuldb.com/?id.323058
- https://vuldb.com/?submit.644954
- https://github.com/advisories/GHSA-g4c9-f287-64xg
- https://nvd.nist.gov/vuln/detail/CVE-2025-10097
- https://github.com/simstudioai/sim/pull/1149/commits/3f790867427275ebae3b3dc75cf1d93d912ac9ca