[ CVE-2026-115726 · Published 23 Oct 2026 ]
Vulnerability in Aider-AI aider
CVSS 7.8
EPSS <1%No fix listed yet
[ Description ]Official description
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.