CVE-2026-10175 is a code injection vulnerability affecting Aider-AI Aider version 0.86.3. The issue resides in the editor_coder.run function of the auth.py file within the Architect Mode component. An attacker can remotely exploit this flaw by manipulating the function to inject arbitrary code. Although the exploit code is publicly available, there is currently no official remediation or patch provided by the vendor. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.

Successful exploitation of this vulnerability allows remote attackers to perform code injection, potentially leading to unauthorized code execution within the affected component. This can compromise the integrity and security of the application environment. The exploit has been publicly released, increasing the risk of active attacks. However, there is no indication of known widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected function or component to trusted users only and apply any available compensating controls to limit exposure.