{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.1.19"}],"component":"simstudio","cve_ids":["CVE-2025-10097"],"ecosystem":"npm","epss":0.0078,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-g4c9-f287-64xg","id":"tcs_01M5KFPZW71DJ0YE7APD9WWT5N","modified_at":"2025-09-15T14:27:20.487180Z","published_at":"2025-09-08T18:31:40Z","references":["https://osv.dev/vulnerability/GHSA-g4c9-f287-64xg","https://nvd.nist.gov/vuln/detail/CVE-2025-10097","https://github.com/simstudioai/sim/issues/961","https://github.com/simstudioai/sim/issues/961#issuecomment-3215578979","https://github.com/simstudioai/sim/pull/1149/commits/3f790867427275ebae3b3dc75cf1d93d912ac9ca","https://github.com/simstudioai/sim","https://vuldb.com/?ctiid.323058","https://vuldb.com/?id.323058","https://vuldb.com/?submit.644954"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-g4c9-f287-64xg","url":"https://osv.dev/vulnerability/GHSA-g4c9-f287-64xg"}],"summary":"SimStudioAI: A function in route.ts is vulnerable to Code Injection"}