TI-2025-13777 CVE-2025-15099 · GHSA-2hg8-9339-xpwg
simstudioai sim CRON Secret internal.ts improper authentication
Priority HIGH 70
A vulnerability was identified in simstudioai sim up to 0.5.27.
SimStudioAI
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
SimStudioAI records in CISA KEVNo SimStudioAI vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records in Sim · all components
TI-2025-06476 CVE-2025-7114 · GHSA-h4g8-77vv-h839
SimStudioAI sim Session route.ts POST missing authentication
Priority HIGH 70
A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b.
TI-2025-06469 CVE-2025-7107 · GHSA-cwqg-729v-5fg2
SimStudioAI sim route.ts handleLocalFile path traversal
Priority HIGH 70
A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17.
TI-2025-09270 CVE-2025-10097 · GHSA-g4c9-f287-64xg
SimStudioAI sim route.ts code injection
Priority MEDIUM 57
A vulnerability was identified in SimStudioAI sim up to 1.0.0.
TI-2025-09269 CVE-2025-10096 · GHSA-q6wr-6g7v-9pxw
SimStudioAI sim route.ts server-side request forgery
Priority MEDIUM 57
A vulnerability was determined in SimStudioAI sim up to 1.0.0.
TI-2025-08994 CVE-2025-9805 · GHSA-84x9-66jh-3jrq
SimStudioAI sim route.ts server-side request forgery
Priority MEDIUM 57
A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2.
TI-2025-08990 CVE-2025-9801 · GHSA-23hh-7w49-jrpv
SimStudioAI sim path traversal
Priority MEDIUM 57
A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af.
TI-2025-08989 CVE-2025-9800 · GHSA-g7mj-wwxq-p2gr
SimStudioAI sim HTML File route.ts import unrestricted upload
Priority MEDIUM 57
A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af.
TI-2026-02962 CVE-2026-3431 · GHSA-h3j6-r52w-6956
Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
Priority MEDIUM 49
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions.
TI-2026-02963 CVE-2026-3432 · GHSA-vwxf-mg49-37v4
Sim Studio AI - Unauthenticated OAuth Token Theft
Priority MEDIUM 48
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters.