Command Execution Vulnerability in Aider by Aider AI

CVE-2026-115726

What is CVE-2026-115726?

Aider, up to version 0.86.2, contains a command execution vulnerability that permits attackers to execute arbitrary shell commands. This occurs through the manipulation of a malicious .aider.conf.yml file, which is automatically loaded without a trust prompt. By setting specific parameters like notifications-command or editor values, malicious actors can trigger subprocess execution with shell=True, thereby running unauthorized commands under the victim's privileges following model responses or instances of /editor use.

References