CVE-2026-84887: simular-ai Agent-S DOS Vulnerability

CVE-2026-84887 Overview

CVE-2026-84887 affects simular-ai Agent-S up to version 0.3.2. The vulnerability resides in unknown functionality within the grounding.py file, part of the Model-generated GUI Action Execution Workflow component. Attackers can manipulate action parameters to trigger a denial of service condition. The issue is remotely exploitable and requires low privileges without user interaction. A public exploit report is available in a GitHub repository. The vendor was contacted before public disclosure but did not respond. The weakness is classified as [CWE-404] Improper Resource Shutdown or Release.

Critical Impact
Remote attackers with low privileges can trigger a denial of service in Agent-S through crafted GUI action parameters processed by grounding.py.

Affected Products

simular-ai Agent-S versions up to and including 0.3.2
The grounding.py file within the Model-generated GUI Action Execution Workflow component
Deployments exposing Agent-S action execution to remote input

Discovery Timeline

2026-09-03 - CVE-2026-84887 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84887

Vulnerability Analysis

Agent-S is an agent framework that executes GUI actions generated by an underlying model. The vulnerability sits in the code path that parses and applies model-generated action parameters inside grounding.py. An attacker who can influence the parameters passed into this workflow can cause the agent to consume or fail to release resources, producing a denial of service. Because the flaw maps to [CWE-404], the root issue is improper handling of resource lifecycle during action execution rather than memory corruption or code execution. The vendor has not responded to disclosure, and no patched release is currently referenced in NVD.

Root Cause

The root cause is improper resource shutdown or release when Agent-S processes model-generated GUI action parameters. Parameter values that exceed the intended budget or shape are not constrained, allowing repeated or oversized allocations that are not cleanly released. This behavior maps to the AgentS_Action_Parameter_Budget_DoS category described in the public GitHub CVE DoS Report.

Attack Vector

Exploitation occurs over the network against a running Agent-S instance. An attacker with low-level access to the action pipeline supplies crafted parameters that pass through grounding.py. The agent then enters a state where resources are exhausted or held, and the workflow becomes unavailable. No user interaction is required. Full technical context is available in the VulDB entry for CVE-2026-84887.

No verified exploit code is republished here. See the public proof-of-concept report for the researcher's technical description.

Detection Methods for CVE-2026-84887

Indicators of Compromise

Agent-S processes hanging or terminating during GUI action execution with unusually large or repeated parameter payloads.
Sudden growth in memory, file handle, or thread usage tied to grounding.py execution paths.
Repeated inbound requests to Agent-S action endpoints from a single source producing oversized action parameter structures.

Detection Strategies

Instrument grounding.py and surrounding modules with logging that captures action parameter size, count, and origin.
Baseline normal resource consumption for Agent-S workloads and alert on sustained deviation.
Correlate agent unavailability events with upstream model outputs and remote input sources to identify hostile parameter patterns.

Monitoring Recommendations

Track process-level CPU, memory, and handle counts for Agent-S runtimes and alert on saturation.
Monitor availability probes on any service exposing the Agent-S action workflow.
Retain request and action logs long enough to reconstruct denial of service events for post-incident review.

How to Mitigate CVE-2026-84887

Immediate Actions Required

Restrict network exposure of Agent-S action execution endpoints to trusted callers only.
Enforce authentication and authorization on any interface that feeds parameters into grounding.py.
Apply upstream input validation and size limits on model-generated GUI action parameters before they reach the agent.
Isolate Agent-S deployments in containers with strict CPU, memory, and file-handle limits to contain resource exhaustion.

Patch Information

As of the NVD publication date of 2026-09-03, no vendor patch is referenced for CVE-2026-84887. The vendor did not respond to disclosure attempts. Track the VulDB vulnerability record #398136 and the simular-ai Agent-S project for a fixed release beyond version 0.3.2.

Workarounds

Wrap Agent-S execution in a supervisor that enforces per-request timeouts and automatically restarts failed workers.
Add a parameter budget filter in front of grounding.py that rejects oversized or malformed action structures.
Rate-limit inbound requests to the action execution workflow to blunt sustained abuse.
Run Agent-S under a dedicated low-privilege account with cgroup or equivalent resource caps to preserve host availability.

bash

# Example: cgroup-style resource caps for an Agent-S worker
systemd-run --scope \
  -p MemoryMax=1G \
  -p CPUQuota=50% \
  -p TasksMax=256 \
  python -m agent_s.worker