Read the docs
TI-2026-58786 Aliases CVE-2026-85674GHSA-h3gc-qfjg-2m69

aider 0.86.2 Remote Code Execution via .aider.conf.yml

Priority LOW 38CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aider-AIaiderup to 0.86.2—No fix listedCNA
  • aider VendorAider-AI Affected up to 0.86.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85674
  2. 2026-10-03 Alias added: GHSA-h3gc-qfjg-2m69

References

Other 3

  • TI-2026-79730 Command injection in Aider via malicious .aider.conf.yml CVSS 4.0HIGH 8.5
  • TI-2026-08915 Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery CVSS 4.0MEDIUM 5.3
  • TI-2026-08912 Aider-AI Aider Pre-commit Hook args.py protection mechanism CVSS 4.0MEDIUM 5.3
  • TI-2026-08913 Aider-AI Aider Architect Mode auth.py editor_coder.run code injection CVSS 4.0MEDIUM 5.3
  • TI-2026-08914 Aider-AI Aider Code Generation Workflow sql injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences