CVE-2026-84887: simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the component Model-generated GUI Action Execution Workflow. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review simular-ai Agent-S deployments running versions up to 0.3.2 that expose or use the Model-generated GUI Action Execution Workflow. The issue is remotely exploitable and affects functionality in grounding.py.
What level of access does an attacker need?
The supplied severity vector indicates low privileges are required, while no user interaction is required. The attack can be conducted remotely.
What is the operational impact?
Successful exploitation can cause a denial of service. The available information does not indicate confidentiality or integrity impact.
Is exploit code available?
Yes. The vulnerability information states that a public exploit is available and might be used.
Is a vendor fix or workaround identified?
No fix or workaround is provided in the available data. The vendor was contacted but did not respond.