Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85674aider 0.86.2 Remote Code Execution via .aider.conf.yml

High 7.8

In plain English

A high-severity code injection in aider from Aider-AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

Affected products (as reported)

Vendor	Product	Versions
Aider-AI	aider	0 – through 0.86.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Issue #5254 issue-tracking
https://github.com/Aider-AI/aider product
https://github.com/Aider-AI/aider/blob/v0.86.2/aider/main.py technical-description
VulnCheck Advisory: aider 0.86.2 Remote Code Execution via .aider.conf.yml third-party-advisory