Threats tagged 'ghsa-vfc8-q896-v58j'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.5%	CVE-2026-86115simstudioai sim · Confused Deputy Medium5.3EPSS 0.5%2026-09-05CVE Database V5CVE-2026-86115 Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute. EPSS 0.5%Vulnerability #ghsa-vfc8-q896-v58j	CVE Database V5	2026-09-05

Page 1 of 1