CVE-2026-84885: Denial of Service in simular-ai Agent-S

This vulnerability in simular-ai Agent-S 0.3.1 and 0.3.2 involves a denial of service condition triggered by manipulating an unknown function within the code_agent.py file of the CodeAgent component. The attack vector is remote network access with low attack complexity and no required privileges or user interaction. The vulnerability is identified as CWE-404 (Improper Resource Shutdown or Release). Although the vendor was notified, no fix or response has been provided, and no patch links exist. Public exploit information is available, but no active exploitation has been confirmed.

Successful exploitation results in denial of service, potentially disrupting availability of the affected software. The vulnerability can be triggered remotely without authentication or user interaction, increasing the risk of impact. However, there is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available from the vendor. Users should monitor vendor communications for updates. In the absence of a patch, consider implementing network-level protections to restrict access to the affected component if feasible. Since the vendor has not responded and no official remediation exists, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.