CVE-2026-10174
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was identified in Aider version 0.86.3 in an unknown function of file aider/args.py in the Pre-commit Hook Handler component. Manipulation of the argument git-commit-verify leads to protection mechanism failure. The attack may be launched remotely, and the exploit is publicly available. The project was informed but did not respond.
Risk Assessment
Organizations using Aider are at risk of protection mechanism bypass, potentially allowing an attacker to perform unauthorized operations, possibly leading to repository integrity compromise.
Recommendation
Stop using Aider until a patch is released, or apply a temporary workaround such as restricting access to the tool.
Other vulnerabilities in Aider
See all- CVE-2026-10177Medium
Vulnerability in Aider (Aider-AI) version 0.86.3 allows SSRF (Server-Side Request Forgery) through manipulation in the requests.get function of the api_docs.py file, affecting the AWS EC2 Metadata Endpoint component.
- CVE-2026-10176Medium
A vulnerability was found in Aider 0.86.3 by Aider-AI in the Code Generation Workflow component. An unknown functionality allows SQL injection. The attack can be performed remotely and the exploit has been published.
Original NVD description (English source)
A vulnerability was identified in Aider-AI Aider 0.86.3. Affected is an unknown function of the file aider/args.py of the component Pre-commit Hook Handler. Such manipulation of the argument git-commit-verify leads to protection mechanism failure. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.