CVE-2026-85674: aider 0.86.2 Remote Code Execution via .aider.conf.yml
aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aider-chatto a version that resolves this vulnerability.Fixed in 0.86.2 - Compensating control
Do not run aider (aider-chat) inside attacker-supplied/untrusted git repositories, since aider auto-loads .aider.conf.yml from the repository root and can execute test-cmd/lint-cmd via subprocess(..., shell=True) without user confirmation.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who launch aider from within a Git repository supplied by an attacker are exposed. The attacker-controlled repository can include a root-level .aider.conf.yml file that aider loads automatically.
Does exploitation require an API key, LLM interaction, or confirmation from the user?
No. The described command execution does not require an API key, LLM interaction, or a user confirmation prompt.
When can attacker-controlled commands run?
A test-cmd value can run when aider starts. A lint-cmd value can run when the user performs their first file edit.