CVE-2026-85674

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in, and runs any test-cmd at startup and lint-cmd on the first file edit through a shell (subprocess with shell=True) without user confirmation, LLM interaction, or an API key. An attacker who hosts a repository containing a crafted .aider.conf.yml can therefore achieve arbitrary command execution on the machine of any user who clones that repository and runs aider inside it, consistent with the local-attack, user-interaction CVSS 4.0 score of 8.5 (AV:L/UI:P). The behavior is long-standing and was confirmed on 0.86.3.dev (current main), so all versions with this auto-load behavior are affected and no fixed version is identified in the available data. The affected population is developers who run aider in repositories they did not author. Exploitation has not been observed: there is no known public PoC, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.

What to do: Before running aider in any repository you did not author, inspect .aider.conf.yml at the repo root — especially test-cmd, lint-cmd, and similar *-cmd settings — or run aider on untrusted clones inside a sandbox or container. Since no patched release is specified in the available data and the behavior is confirmed on current main, monitor the aider project for an advisory or fix. Treat cloned repositories from unknown sources as untrusted input, as with any tool that auto-executes per-repo configuration.