CVE-2026-115726
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
Risk Assessment
An attacker can execute arbitrary commands with the victim's privileges, leading to full compromise of the developer workstation.
Recommendation
Update Aider to a version later than 0.86.2 and avoid running it in directories containing untrusted .aider.conf.yml files.
Other vulnerabilities in Aider
See all- CVE-2026-85674High
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine.
- CVE-2026-10177Medium
Vulnerability in Aider (Aider-AI) version 0.86.3 allows SSRF (Server-Side Request Forgery) through manipulation in the requests.get function of the api_docs.py file, affecting the AWS EC2 Metadata Endpoint component.
- CVE-2026-10176Medium
A vulnerability was found in Aider 0.86.3 by Aider-AI in the Code Generation Workflow component. An unknown functionality allows SQL injection. The attack can be performed remotely and the exploit has been published.
- CVE-2026-10174Medium
A vulnerability was identified in Aider version 0.86.3 in an unknown function of file aider/args.py in the Pre-commit Hook Handler component. Manipulation of the argument git-commit-verify leads to protection mechanism failure. The attack may be launched remotely, and the exploit is publicly available. The project was informed but did not respond.
Original NVD description (English source)
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS