Threats Tagged 'ghsa-qf42-jvf7-pgg2'

Aider-AI's aider software up to version 0.86.2 contains an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by committing a malicious .aider.conf.yml configuration file that is auto-loaded without user confirmation. The vulnerability arises because certain configuration values (notifications-command or editor) are executed via subprocess with shell=True, enabling command execution with the victim's privileges after model replies or editor use.