Log in Start free

Vulnerability · Published May 31, 2026 · Assigned by VulDB

CVE-2026-10175Aider-AI Aider Architect Mode auth.py editor_coder.run code injection

Medium 6.3

In plain English

A medium-severity code injection in Aider from Aider-AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 84.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Aider-AI Aider 0.86.3. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIaider-chatno fix listedGHSA-7w7m-v5vp-w699
PyPIaider-chatno fix listedPYSEC-2026-2335

Affected products (as reported)

VendorProductVersions
Aider-AI Aider 0.86.3

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References