CVE-2026-84885
Received Received - Intake

Denial of Service in simular-ai Agent-S CodeAgent

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84885
EUVD
EUVD-2026-70283

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
simular-ai agent-s 0.3.1
simular-ai agent-s 0.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service (DoS) flaw in the simular-ai Agent-S framework, specifically in the CodeAgent tool. When the local coding environment is enabled, a normal task prompt can trigger the agent to execute Python code without any safeguards like timeouts or memory limits. A malicious or malformed Python program generating excessive output can exhaust the worker process memory, causing the service to crash.

Detection Guidance

To detect this vulnerability, monitor for abnormal memory usage or process termination in the Agent-S CodeAgent worker. Check Docker containers for OOMKilled status. Inspect logs for Python subprocesses running without timeouts or resource limits.

Impact Analysis

If exploited, this vulnerability can disrupt normal operations of the Agent-S framework by crashing the CodeAgent worker. In a shared environment, a single malicious prompt could monopolize resources, leading to service unavailability and potential downtime for all users relying on the agent-based system.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions or unavailability due to denial of service. GDPR requires data processing systems to ensure availability and resilience, while HIPAA mandates safeguards against unauthorized access or disruptions. A DoS condition may violate these requirements by compromising system availability.

Mitigation Strategies
  • Add timeouts to Python script execution in CodeAgent.
  • Enforce stdout/stderr byte limits for subprocess output.
  • Run subprocesses in sandboxes with resource limits.
  • Implement per-task budgets to prevent resource exhaustion.
  • Reject oversized tool results to block malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart