Threats affecting pkg:github/aider-ai/aider

CVE-2026-10177 is a server-side request forgery (SSRF) vulnerability affecting Aider-AI Aider version 0.86.3. The flaw exists in the requests.get function within the api_docs.py file, specifically related to the AWS EC2 Metadata Endpoint component. This vulnerability can be exploited remotely. A patch has been developed and is awaiting acceptance. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A code injection vulnerability exists in Aider-AI Aider version 0.86.3 within the function editor_coder.run in the auth.py file of the Architect Mode component. This flaw allows remote attackers to inject code by manipulating the function. The vulnerability has a medium severity score of 5.3 and an exploit has been publicly released. The vendor has been informed but has not yet responded or provided a fix.

CVE-2026-10174 is a medium severity vulnerability in Aider-AI Aider version 0.86.3 involving a protection mechanism failure in the Pre-commit Hook Handler component. The issue arises from manipulation of the argument git-commit-verify in the aider/args.py file. The vulnerability can be exploited remotely, and a public exploit is available. The vendor has been informed but has not yet responded or provided a fix. No official patch or remediation guidance is currently available.