# Aider: a repo's own config file runs shell commands, unpatched

> Aider loads a repository's .aider.conf.yml with no trust prompt, so a committed config value can run shell commands.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-23
- **CVE:** CVE-2026-115726
- **CVSS:** 8.5
- **Affects:** Aider
- **Research by:** Seoyoung Lee
- **Primary source:** https://vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-settings
- **Page:** https://theinjection.dev/items/aider-conf-yml-command-execution/

Aider 0.86.2 and earlier run shell commands taken from a repository's .aider.conf.yml with no trust prompt. Opening an untrusted repo can execute the attacker's command. VulnCheck rates it 8.5. No fixed version has shipped.

## What happened

VulnCheck published CVE-2026-115726 on 23 October 2026 and credited Seoyoung Lee with the finding. The report was filed as a public GitHub issue on 20 October because, as the report states, Aider has no dedicated security reporting channel. Aider's maintainers had not responded and no fix had shipped when the advisory went out.

## How it works

Aider reads .aider.conf.yml from the repository root and honours two keys that hold commands: notifications-command and editor. Both values reach a subprocess call made with shell=True, so shell metacharacters inside them are interpreted. The notifications-command path fires after the model replies, and the editor path fires when the user types /editor. VulnCheck classifies the weakness as CWE-78, OS command injection, driven by repository-controlled configuration rather than by prompt injection.

## Who is affected

Aider 0.86.2 and every earlier version are affected, and the reporter confirmed both sinks on that release and on the development branch at commit 5dc9490. Anyone who starts Aider inside a repository they did not write is exposed, including clones of public projects and repositories received as archives.

## What to do

Avoid starting Aider in a repository you do not trust until a fix ships. Look for an .aider.conf.yml at the repository root and read its notifications-command and editor values before running the agent.

## Quick facts

- **Affected:** Aider 0.86.2 and earlier, plus dev commit 5dc9490
- **Fixed in:** No fix released
- **CVE:** CVE-2026-115726
- **CVSS:** 8.5, CVSS 4.0, assigned by VulnCheck
- **Found by:** Seoyoung Lee
- **Disclosed:** 23 October 2026
- **Attack type:** OS command injection via repository config

## Questions

### Is there a patched version of Aider for CVE-2026-115726?

No patched Aider release existed when VulnCheck published the advisory on 23 October 2026. The GitHub issue documenting the flaw remained open, with no maintainer response, no assignee and no linked pull request. Aider users should keep away from untrusted repositories until the project ships a release that stops honouring command-bearing keys taken from a repository-root configuration file.

### How do I check whether a repository can exploit Aider through .aider.conf.yml?

Look in the repository root for a file named .aider.conf.yml before starting Aider. Two keys matter: notifications-command and editor. A shell command, a pipe or other shell metacharacters in either value points to an exploit attempt, because Aider passes both to a subprocess created with shell=True. Removing the file, or those two keys, closes this specific path.

### Does exploiting CVE-2026-115726 need the user to do anything?

Running Aider inside the malicious repository is enough for the notifications-command path, which fires once the model has replied. The editor path needs one further step, the user typing the /editor command. Neither path shows a trust prompt or a confirmation, so a victim gets no warning before a command supplied by the repository runs with their privileges.

### Was CVE-2026-115726 reported to Aider privately first?

No private channel was used, and the report gives the reason: Aider has no dedicated security reporting channel. Seoyoung Lee sent the finding to VulnCheck, and a public GitHub issue was opened on 20 October 2026 to serve as a reference for CVE assignment. VulnCheck published the advisory three days later, on 23 October 2026.

## Sources

1. [VulnCheck Advisory](https://vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-settings)
2. [Aider Issue 5885](https://github.com/Aider-AI/aider/issues/5885)
3. [Vulnerable Code](https://github.com/Aider-AI/aider/blob/v0.86.2/aider/io.py)