This vulnerability in Aider-AI Aider 0.86.3 allows an attacker to manipulate the requests.get call in the api_docs.py component that interacts with the AWS EC2 Metadata Endpoint, resulting in server-side request forgery. The flaw enables remote attackers to induce the server to make unintended requests, potentially accessing internal resources. Although the exploit is publicly known, no known exploits in the wild have been reported. A patch is available but pending acceptance. The product is a cloud service, so remediation may be managed by the vendor.

Successful exploitation could allow an attacker to make unauthorized requests from the server to internal or external resources, potentially exposing sensitive information or enabling further attacks. The medium CVSS score reflects limited privileges required and partial impact on confidentiality, integrity, and availability. No confirmed active exploitation has been reported.

A patch addressing this vulnerability has been developed and is awaiting acceptance. Since Aider is a cloud-hosted service, the vendor typically manages remediation server-side. Users should monitor vendor advisories for patch deployment status and apply updates once the fix is officially released. Until then, no additional mitigation steps are confirmed by the vendor.