CVE-2026-85674: Improper Control of Generation of Code ('Code Injection') in Aider-AI aider

The vulnerability arises because aider automatically executes shell commands specified in the .aider.conf.yml configuration file located in the root of the git repository it is launched in. Specifically, the test-cmd (executed at startup) and lint-cmd (executed on first file edit) are run through a shell subprocess with shell=True, without any user confirmation or interaction. This allows an attacker who convinces a user to clone and run aider inside a malicious repository to execute arbitrary commands on the victim's machine. This behavior is confirmed in version 0.86.3.dev and affects all versions up to 0.86.2.

An attacker can achieve arbitrary command execution on the victim's machine by supplying a malicious git repository that contains a crafted .aider.conf.yml file. This can lead to full compromise of the user's environment where aider is run, potentially allowing data theft, system manipulation, or further malware deployment. The vulnerability requires the user to clone and run aider inside the attacker-controlled repository, and user interaction is required to trigger execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running aider in untrusted or attacker-controlled git repositories. Review and sanitize .aider.conf.yml files before running aider commands. Monitor official Aider-AI channels for updates and patches addressing this issue.