Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
Priority LOW 25CWE-441Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix Fixed sim (simstudioai): 0.8.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SimStudioAI | sim | before 0.8.14 | 0.8.14 | Patch available | CNA |
- sim VendorSimStudioAI Affected before 0.8.14 Fixed in 0.8.14 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sim:sim:*:*:*:*:*:*:*:* | — | — | SimStudioAI |
- cpe:2.3:a:sim:sim:*:*:*:*:*:*:*:* Versions — — ·SimStudioAI
Remediation
- Fix · CNA sim (simstudioai) Fixed in 0.8.14
Timeline
- 2026-10-02 Threatist record created from CVE-2026-86115
- 2026-10-03 Alias added: GHSA-vfc8-q896-v58j
References
More SimStudioAI vulnerabilities
- TI-2025-13777 simstudioai sim CRON Secret internal.ts improper authentication CVSS 4.0MEDIUM 6.9
- TI-2025-06476 SimStudioAI sim Session route.ts POST missing authentication CVSS 4.0MEDIUM 6.9
- TI-2025-06469 SimStudioAI sim route.ts handleLocalFile path traversal CVSS 4.0MEDIUM 6.9
- TI-2026-11435 SimStudioAI sim Password Protection deployment.ts weak hash CVSS 4.0MEDIUM 6.3
- TI-2025-09270 SimStudioAI sim route.ts code injection CVSS 4.0MEDIUM 5.3
- TI-2025-09269 SimStudioAI sim route.ts server-side request forgery CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-86115 · CVE Program
- CVE-2026-86115 · NVD
- FIRST EPSS
- GHSA-vfc8-q896-v58j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences