Threat database

Aider-AI's aider software up to version 0.86.2 contains an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by committing a malicious .aider.conf.yml configuration file that is auto-loaded without user confirmation. The vulnerability arises because certain configuration values (notifications-command or editor) are executed via subprocess with shell=True, enabling command execution with the victim's privileges after model replies or editor use.

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

CVE-2026-10177 is a server-side request forgery (SSRF) vulnerability affecting Aider-AI Aider version 0.86.3. The flaw exists in the requests.get function within the api_docs.py file, specifically related to the AWS EC2 Metadata Endpoint component. This vulnerability can be exploited remotely. A patch has been developed and is awaiting acceptance. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A code injection vulnerability exists in Aider-AI Aider version 0.86.3 within the function editor_coder.run in the auth.py file of the Architect Mode component. This flaw allows remote attackers to inject code by manipulating the function. The vulnerability has a medium severity score of 5.3 and an exploit has been publicly released. The vendor has been informed but has not yet responded or provided a fix.

CVE-2026-10174 is a medium severity vulnerability in Aider-AI Aider version 0.86.3 involving a protection mechanism failure in the Pre-commit Hook Handler component. The issue arises from manipulation of the argument git-commit-verify in the aider/args.py file. The vulnerability can be exploited remotely, and a public exploit is available. The vendor has been informed but has not yet responded or provided a fix. No official patch or remediation guidance is currently available.