CVE-2026-85674
Received Received - Intake

Command Execution in Aider Chat via Malicious Config

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85674
EUVD
EUVD-2026-71130

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
aider-ai aider 0.86.2
aider-ai aider From 0.86.3.dev (inc)
aider aider-chat 0.86.3.dev

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in aider (aider-chat) allows arbitrary command execution when a user clones and runs aider inside a malicious Git repository. The tool automatically loads a .aider.conf.yml file from the repository root and executes commands defined in test-cmd or lint-cmd without user confirmation or validation. These commands run through a shell, enabling attackers to execute arbitrary code on the victim's machine.

Detection Guidance

Check for the presence of .aider.conf.yml files in Git repositories. Inspect these files for test-cmd or lint-cmd entries that execute unexpected commands. Use commands like 'find /path/to/repo -name ".aider.conf.yml" -exec cat {} \;' to view configuration files.

Impact Analysis

If you clone and run aider in an attacker-controlled repository, this vulnerability allows arbitrary code execution on your machine. Attackers could steal data, install malware, or perform other malicious actions without your knowledge or consent. The impact includes potential system compromise, data breaches, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized data access, exfiltration, or system compromise. Organizations using aider may face legal penalties, reputational damage, or loss of certification if sensitive data is exposed due to this flaw.

Mitigation Strategies

Avoid running aider in untrusted repositories. Update aider to the latest version if a patch is available. Disable automatic loading of .aider.conf.yml from untrusted sources. Review configuration files for suspicious commands before execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart