Aider: Command execution via malicious repository .aider.conf.yml
Summary
Aider through version 0.86.2 executes shell commands defined in a repository's .aider.conf.yml file, which is loaded automatically without a trust prompt. An attacker who commits such a file can set notifications-command or editor values that run with shell=True after model replies or /editor use. The commands run with the privileges of the developer using aider in that repository, so source code, API keys and cloud credentials could be exposed.
Affected
- aider (PyPI package aider-chat) versions 0.86.2 and earlier (CNA: VulnCheck)
Fixed in
Unknown. No fixed version or vendor advisory has been published.
Workaround
- Do not run aider in untrusted repositories.
- Inspect any .aider.conf.yml before running aider in a repository.
- Use your own configuration and do not accept commands supplied by a repository.
- Require a review for commits that change .aider.conf.yml.
- Run aider in a VM, container or restricted user account for untrusted projects.
Exploitation
- No evidence of exploitation in the wild; not listed as known exploited.
- CISA SSVC: exploitation status PoC, not automatable, total technical impact.
- Upstream issues publicly describe reproduction of the behaviour.
Our recommendation
- Inventory systems where aider is installed (for example with pip show aider-chat).
- Apply the workarounds above until a fixed version is available.
- Monitor the upstream issue and releases for a fix.
- Review related reports CVE-2026-85674 and issue #5772, which describe further repository configuration risks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory for CVE-2026-115726 www.vulncheck.com
- Aider upstream issue #5885 github.com
- Aider upstream issue #5254 (reproduction reports) github.com
- Aider GitHub security page github.com
- Aider editor.py at v0.86.2 github.com
- Aider issue #5772 (per-repo config and command environment) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:13.
Original description (NVD)
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
NVD references (6)
- https://github.com/Aider-AI/aider/blob/v0.86.2/aider/editor.py#L89-L134
- https://github.com/Aider-AI/aider/blob/v0.86.2/aider/io.py#L1088-L1094
- https://github.com/Aider-AI/aider/blob/v0.86.2/aider/main.py#L464-L479
- https://github.com/Aider-AI/aider/issues/5885
- https://www.vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-set…
- https://github.com/Aider-AI/aider/issues/5885
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.