CVE-2026-84887: Denial of Service in simular-ai Agent-S

This vulnerability in simular-ai Agent-S up to version 0.3.2 involves a denial of service condition triggered by manipulating an unspecified function in the grounding.py file of the Model-generated GUI Action Execution Workflow component. The flaw allows remote attackers to cause a denial of service without requiring user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although the vendor was notified early, no response or patch has been provided. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation results in denial of service, potentially disrupting the availability of the affected component or application. The attack can be performed remotely without user interaction or elevated privileges, which increases the attack surface. However, there is no indication of data confidentiality or integrity impact. No active exploitation in the wild has been reported to date.

No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, consider implementing network-level protections to restrict access to the affected service and limit exposure to untrusted networks. Review application logs for unusual activity related to grounding.py if possible.