CVE-2025-10097: SimStudioAI: A function in route.ts is vulnerable to Code Injection
(updated )
A vulnerability was identified in SimStudioAI sim. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
References
- github.com/advisories/GHSA-g4c9-f287-64xg
- github.com/simstudioai/sim
- github.com/simstudioai/sim/issues/961
- github.com/simstudioai/sim/issues/961
- github.com/simstudioai/sim/pull/1149/commits/3f790867427275ebae3b3dc75cf1d93d912ac9ca
- nvd.nist.gov/vuln/detail/CVE-2025-10097
- vuldb.com/?ctiid.323058
- vuldb.com/?id.323058
- vuldb.com/?submit.644954
Code Behaviors & Features
Detect and mitigate CVE-2025-10097 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →