CVE-2025-10097: Medium Code Injection in SimStudioAI Sim

CVE-2025-10097 is a medium severity code injection (CVSS 6.3) in SimStudioAI sim up to 1.0.0, in the function execute API route. The project issue was closed as resolved in September 2025, but no release was linked, so confirm your build includes the fix.

What's affected

The record names SimStudioAI sim up to 1.0.0. The affected file is apps/sim/app/api/function/execute/route.ts, and the code argument leads to code injection. The weakness classes are CWE-94 (code injection) and CWE-74 (injection).

The score is 6.3 MEDIUM. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reads as network reachable, low attack complexity, a low-privilege account and no user interaction. Impact on confidentiality is limited, on integrity limited, and on availability limited.

The project's GitHub issue 961 describes the route as passing code supplied by a user into a Node.js vm script. It was reported in August 2025 against the latest version at that time and gave no version number. A commenter noted that the code had since gained allowlisting and protections beyond Docker sandboxing. On September 19, 2025, a project collaborator replied that it was resolved and closed the issue as completed. The thread does not link a pull request, commit or release, so I cannot name a fixed version. Check the project's releases and security advisories.

How to check if you're exposed

1. Find out how you run Sim: from the hosted service, from a container or from source.
2. If you self host, check the version or commit you deployed against the project's release notes.
3. Search your deployment for the route file and look at how the code is executed.

grep -rn "vm\." apps/sim/app/api/function/execute/route.ts

4. Check whether the execute endpoint is reachable from outside your network, and who can call it.

What to do now

1. Update to the latest Sim release and read the notes for changes to the function execute route.
2. Do not expose the instance to untrusted users until you have confirmed the fix.
3. Run the service with the lowest privileges possible, in a container with limited network and file access.
4. Remove secrets that the process does not need, so injected code has little to read.
5. Put authentication in front of the endpoint if your deployment does not already do so.
6. Re-test after upgrading with a security review, because a closed issue is not a verified patch. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.

Why it matters

Workflow tools that let users write and run code are useful and dangerous in equal measure. The Node.js vm module is not a security boundary, and its own documentation says so. Code run in a vm context can often reach the host process. Real isolation needs a separate process, container or virtual machine with tight limits.

That is the class of weakness here: untrusted input reaches a code evaluator. The record is not flagged by CISA as exploited in the wild, and I found no statement of exploitation. The CVSS score is medium, but the real risk depends on how your instance is exposed and what the process can reach.

Quick check

Sources

• simstudioai/sim issue 961
• NVD record for CVE-2025-10097

Last reviewed: 19 October 2026.