Aider vulnerabilities

2 known vulnerabilities in Aider from Aider-AI. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  aider: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-115726Oct 23, 2026Aider-AI

  Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are

• 7.8 High severity

  aider: Improper Control of Generation of Code

  CVE-2026-85674Sep 4, 2026Aider-AI

  aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs throu