# CVE-2026-84885: simular-ai Agent-S denial of service in CodeAgent

Source: https://junglewise.ai/threats/cve-2026-84885-simular-ai-agent-s-denial-of-service-in-codeagent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84885 · Severity: medium · CVSS 4.3 · Published 2026-09-03

Agent-S is an autonomous agent framework that can execute code locally. A vulnerability in its CodeAgent tool allows an attacker to craft a prompt that forces the system to execute a Python script with unbounded output, exhausting the worker process's memory and crashing the service. This results in a complete denial of service affecting all users of the shared CodeAgent worker.

Technologies: [Simular-Ai Agent-S](https://junglewise.ai/threats/technologies/agent-s). Vendors: [Simular-Ai](https://junglewise.ai/threats/vendors/simular-ai).

## Quick answers

**Is CVE-2026-84885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84885 being exploited in the wild.

**How severe is CVE-2026-84885?** Medium severity, with a CVSS score of 4.3, published 3 September 2026.

**Which products and versions are affected?** Simular-Ai Agent-S 0.3.1, 0.3.2.

**Is there a fix for CVE-2026-84885?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84885 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84885?** Check whether you run Simular-Ai Agent-S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service flaw in the CodeAgent component (code_agent.py) of Agent-S versions 0.3.1 and 0.3.2. The root cause is missing resource limits on Python subprocess execution: while bash execution has a 30-second timeout, Python execution has no timeout, CPU budget, memory budget, or stdout/stderr byte limit. An attacker can send a crafted low-trust task prompt that causes the LLM to generate a Python program with large bounded output (e.g., 900 iterations of 1 MB+ strings). The subprocess output is buffered entirely in memory before being returned to the agent, causing the worker process to exhaust available memory and be killed (OOMKilled). The attack is remotely exploitable through the CodeAgent integration endpoint. The vendor has not yet responded to the disclosure.

## Affected products

- simular-ai Agent-S 0.3.1, 0.3.2

## Timeline

- 2026-09-03: disclosed: CVE-2026-84885 published on NVD; exploit PoC disclosed publicly on GitHub
- 2026-09-03: other: Vendor contacted early but did not respond

## References

- [https://github.com/outlookgp/CVE/tree/main/AgentS_CodeAgent_Tool_Output_DoS_Report](https://github.com/outlookgp/CVE/tree/main/AgentS_CodeAgent_Tool_Output_DoS_Report)
- [https://vuldb.com/cve/CVE-2026-84885](https://vuldb.com/cve/CVE-2026-84885)

## Related threats

- [simular-ai Agent-S denial of service in action parameter handling](https://junglewise.ai/threats/cve-2026-84887-simular-ai-agent-s-denial-of-service-in-action-parameter-handling)
- [simular-ai Agent-S denial of service in OCR HTTP API](https://junglewise.ai/threats/cve-2026-84886-simular-ai-agent-s-denial-of-service-in-ocr-http-api)