This vulnerability in Aider-AI Aider 0.86.3 involves a code injection flaw in the editor_coder.run function of the auth.py file in the Architect Mode component. An attacker can remotely manipulate this function to inject and execute arbitrary code. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vendor has not yet provided a remediation or patch, and public exploit code exists.

Successful exploitation allows remote attackers to inject and execute arbitrary code within the affected application context. This can lead to unauthorized actions, potential data compromise, or system manipulation depending on the environment where Aider-AI Aider is deployed. The presence of public exploit code increases the likelihood of exploitation attempts.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's channels for updates. Until a fix is released, consider restricting network access to the affected component and applying any relevant application-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.