CVE-2026-115726: Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Aider through 0.86.2 in a repository containing an attacker-controlled .aider.conf.yml are exposed. Commands run with the privileges of the user running Aider.
What does an attacker need to do to trigger execution?
An attacker needs to get a malicious .aider.conf.yml committed into a repository that the victim uses with Aider. The file can set notifications-command or editor to a shell command; execution occurs after model replies or when the victim uses /editor.
Does the malicious repository configuration require user approval?
No. The .aider.conf.yml is auto-loaded without a trust prompt.
How can I check a repository for indicators of exposure?
Inspect the repository's .aider.conf.yml for notifications-command or editor settings, especially values that invoke shell commands. Treat unexpected or untrusted values in these settings as potentially malicious.