CVE-2026-85674
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine.
Risk Assessment
The risk includes arbitrary code execution on the user's machine, which can lead to system compromise or data theft.
Recommendation
Avoid running aider in untrusted repositories or disable automatic loading of the configuration file, and require confirmation before executing test-cmd and lint-cmd commands.
Other vulnerabilities in aider
See all- CVE-2026-10177Medium
Vulnerability in Aider (Aider-AI) version 0.86.3 allows SSRF (Server-Side Request Forgery) through manipulation in the requests.get function of the api_docs.py file, affecting the AWS EC2 Metadata Endpoint component.
- CVE-2026-10176Medium
A vulnerability was found in Aider 0.86.3 by Aider-AI in the Code Generation Workflow component. An unknown functionality allows SQL injection. The attack can be performed remotely and the exploit has been published.
- CVE-2026-10174Medium
A vulnerability was identified in Aider version 0.86.3 in an unknown function of file aider/args.py in the Pre-commit Hook Handler component. Manipulation of the argument git-commit-verify leads to protection mechanism failure. The attack may be launched remotely, and the exploit is publicly available. The project was informed but did not respond.
Original NVD description (English source)
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS