Advisory · CVE-2026-115726
Aider runs shell commands from a cloned repo config file with no trust prompt
Aider through 0.86.2 auto-loads a repo .aider.conf.yml with no trust prompt, and its notifications-command and editor values are later run through a shell, so opening an attacker repo in Aider can run commands as the user. CVSS 4.0 8.5.
- Vendor
- Aider-AI
- Product
- Aider
- Identifier / CWE
- CVE-2026-115726
CWE-78 - Action timing
- Immediate
Explain it like I’m five
Aider reads a settings file that comes with a downloaded project and treats two of its lines as shell commands to run later, so a project can tell your copy of Aider to run the project author commands on your machine.
- 01Attacker ships a repo config
An attacker publishes a repository whose root .aider.conf.yml sets notifications on, plus a notifications-command and an editor value they control.
- 02Victim opens the repo in Aider
A user clones the repository and runs Aider inside it, and Aider auto-loads the repo config file with no trust prompt.
- 03Command keys become settings
Per the project issue, the config values flow into Aider as live notifications-command and editor settings, with no confirmation step.
- 04Shell runs the values
After a model reply the notifications value is run through a shell, and the editor value is run the same way when the user uses the editor command.
What happened
VulnCheck disclosed CVE-2026-115726 for Aider, the open-source AI coding assistant distributed as aider-chat: Aider through 0.86.2 contains a command execution vulnerability in how it handles a repository .aider.conf.yml file. Per the detailed report in the Aider project issue tracker, that file is auto-loaded from the working directory and repo root with no trust prompt, and every command-line flag is also accepted as a config key. Two keys, notifications-command and editor, are later executed through a shell. The CVSS 4.0 score is 8.5 and the CVSS 3.1 score is 7.8.
Per the project issue, the notifications-command value is run with shell execution after a model reply, and it can fire again on later turns, while the editor value is run when the user uses the normal editor command to compose a message. Because the attacker controls the whole repo config file, the same file can turn notifications on alongside the command value. No fixed version is named in the NVD record, so no upgrade target is claimed here; the issue suggests treating repo-local config as untrusted and prompting before command-bearing keys are honored.
What to do
- Inventory where Aider is installed and which teams run it on code they did not write themselves.
- Before running Aider in a newly cloned repository, read its .aider.conf.yml and remove or override any notifications-command, editor, test-cmd or lint-cmd values you did not set yourself.
- Do not run Aider on untrusted repositories outside a sandbox or a disposable environment until the project states a fix; no fixed version is named in the NVD record.
- Review shell history, editor invocations and Aider sessions on machines that opened third-party repos for commands you do not recognize.
- Watch the Aider project issue and releases for a trust prompt or other fix, and adopt it once the project states one.
Management note
This turns cloning a repo and opening a popular AI coding tool into code execution, with no prompt to catch it. Until the project ships a stated fix, the control is procedural: treat repo config files as code, review them before the first run, and keep Aider off untrusted code outside a sandbox.