Vulnerabilities

TI-2026-79730 CVE-2026-115726 · GHSA-qf42-jvf7-pgg2

Command injection in Aider via malicious .aider.conf.yml

HIGH 72

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00283 Published 2026-10-23 No fix listed CWE-78

TI-2026-58786 CVE-2026-85674 · GHSA-h3gc-qfjg-2m69

aider 0.86.2 Remote Code Execution via .aider.conf.yml

LOW 38

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00249 Published 2026-09-04 No fix listed CWE-94

TI-2026-08915 CVE-2026-10177 · GHSA-hchg-qm84-cj9p

Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery

MEDIUM 57

A security vulnerability has been detected in Aider-AI Aider 0.86.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00209 Published 2026-05-31 No fix listed CWE-918

TI-2026-08914 CVE-2026-10176 · GHSA-f9g4-qjmq-f49r

Aider-AI Aider Code Generation Workflow sql injection

LOW 23

A weakness has been identified in Aider-AI Aider 0.86.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-05-31 No fix listed CWE-74

TI-2026-08913 CVE-2026-10175 · GHSA-7w7m-v5vp-w699

Aider-AI Aider Architect Mode auth.py editor_coder.run code injection

LOW 24

A security flaw has been discovered in Aider-AI Aider 0.86.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00242 Published 2026-05-31 No fix listed CWE-74

TI-2026-08912 CVE-2026-10174 · GHSA-c3wr-3c4v-6rmh

Aider-AI Aider Pre-commit Hook args.py protection mechanism