This vulnerability in Aider-AI Aider 0.86.3 involves an SQL injection flaw within the Code Generation Workflow component. An attacker can remotely execute crafted input to manipulate SQL queries, potentially leading to unauthorized data access or modification. The vulnerability requires no user interaction and low attack complexity, with no privileges needed. Although the exploit is publicly available, there is currently no official remediation or patch from the vendor.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure, modification, or deletion of data. The vulnerability impacts data confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. Since the attack can be performed remotely without privileges, it poses a tangible risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as input validation and restricting access to the vulnerable component where possible until an official patch is released.