SimStudioAI vulnerabilities

CVEs per yearBy the year they were published

1. 20258
2. 20264

Newest CVEs

• CVE-2026-86115

  Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

  simstudioai · sim

  Medium5.3
• CVE-2026-13510

  SimStudioAI sim Password Protection deployment.ts weak hash

  SimStudioAI · sim

  Medium6.3
• CVE-2026-3432

  Sim Studio AI - Unauthenticated OAuth Token Theft

  SimStudioAI · sim

  Critical9.3
• CVE-2026-3431

  Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

  SimStudioAI · sim

  Critical9.8
• CVE-2025-15099

  simstudioai sim CRON Secret internal.ts improper authentication

  simstudioai · sim

  Medium6.9
• CVE-2025-10097

  SimStudioAI sim route.ts code injection

  SimStudioAI · sim

  Medium5.3
• CVE-2025-10096

  SimStudioAI sim route.ts server-side request forgery

  SimStudioAI · sim

  Medium5.3
• CVE-2025-9805

  SimStudioAI sim route.ts server-side request forgery

  SimStudioAI · sim

  Medium5.3
• CVE-2025-9801

  SimStudioAI sim path traversal

  SimStudioAI · sim

  Medium5.3
• CVE-2025-9800

  SimStudioAI sim HTML File route.ts import unrestricted upload

  SimStudioAI · sim

  Medium5.3