CVE-2026-85674

Name of the Vulnerable Software and Affected Versions aider versions 0 through 0.86.2

Description The software automatically loads a .aider.conf.yml configuration file from the root of the git repository where it is launched. An attacker can craft a repository containing a malicious configuration file that defines test-cmd (executed at startup) or lint-cmd (executed during the first file edit). These commands are executed through a shell without requiring user confirmation, LLM interaction, or an API key, allowing for arbitrary command execution on the user's machine when they run the software within the attacker-supplied repository.

Recommendations For versions 0 through 0.86.2, manually inspect the project folder for a .aider.conf.yml file and review any test or lint command lines before running the software. At the moment, there is no information about a newer version that contains a fix for this vulnerability.