CVE-2026-10175: Aider-AI Aider RCE Vulnerability

CVE-2026-10175 Overview

CVE-2026-10175 is a code injection vulnerability [CWE-74] in Aider-AI Aider version 0.86.3. The flaw resides in the editor_coder.run function within auth.py, part of the Architect Mode component. An authenticated remote attacker can manipulate input to trigger arbitrary code execution within the Aider process context.

A public exploit has been released, and the maintainers were notified through an issue report but have not responded at the time of disclosure.

Critical Impact
Remote attackers with low privileges can inject code through the Architect Mode editor coder, impacting confidentiality, integrity, and availability of the host running Aider.

Affected Products

Aider-AI Aider 0.86.3
Component: Architect Mode (auth.py)
Function: editor_coder.run

Discovery Timeline

2026-05-31 - CVE-2026-10175 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10175

Vulnerability Analysis

The vulnerability exists in Aider, an AI pair programming command-line tool. The editor_coder.run function in auth.py processes input within Architect Mode without adequate neutralization of special elements used in downstream code paths.

This falls under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). When attacker-controlled data reaches the editor coder's run routine, the input is interpreted as code rather than data. The result is execution of arbitrary instructions inside the Aider runtime.

The public exploit demonstrates network-based exploitation with low attack complexity. The attacker must hold low-privilege access and no user interaction is required. Impact spans confidentiality, integrity, and availability at a limited scope, consistent with execution constrained to the Aider process and any resources it touches.

Root Cause

The root cause is insufficient input sanitization in editor_coder.run. Special characters or constructs passed through Architect Mode are not neutralized before being consumed by a downstream interpreter or evaluator. Refer to GitHub Aider Issue #5058 for additional technical context.

Attack Vector

Exploitation occurs over the network against an Aider instance running in Architect Mode. The attacker submits crafted content that reaches the vulnerable editor_coder.run path. Once parsed, the payload executes within the Aider process. See the VulDB entry for CVE-2026-10175 for additional advisory details.

No verified proof-of-concept code is reproduced here. Defenders should consult the upstream issue tracker and the Aider project repository for indicators tied to the public exploit.

Detection Methods for CVE-2026-10175

Indicators of Compromise

Unexpected child processes spawned by the Aider runtime or its Python interpreter on hosts running version 0.86.3.
Anomalous file writes, outbound connections, or shell command invocations originating from sessions using Architect Mode.
Modification of auth.py or other Aider source files outside of normal update workflows.

Detection Strategies

Monitor process lineage for the Aider CLI and flag execution of shells, package managers, or interpreters as children of the Aider process.
Inspect Architect Mode session logs for input containing code constructs, escape sequences, or shell metacharacters not associated with legitimate prompts.
Correlate developer endpoint telemetry with network egress from Aider processes to non-LLM-provider destinations.

Monitoring Recommendations

Enable command-line auditing on developer workstations and CI agents that run Aider to capture invocation parameters and child process arguments.
Centralize Aider runtime logs and developer endpoint telemetry for retrospective hunting against the public exploit pattern.
Track installations of Aider 0.86.3 across the environment using software inventory data and alert on use until a patched release is published.

How to Mitigate CVE-2026-10175

Immediate Actions Required

Restrict use of Aider 0.86.3, particularly Architect Mode, to trusted local input until the project issues a fix.
Run Aider under a dedicated low-privilege account isolated from production credentials, source repositories with write access, and sensitive data.
Block network exposure of any Aider instance accepting remote input and require authenticated, segmented access.

Patch Information

No vendor patch is available at publication. The maintainers were notified through GitHub Aider Issue #5058 but have not responded. Track the Aider project repository for an updated release that addresses input neutralization in editor_coder.run.

Workarounds

Disable Architect Mode in environments where remote or untrusted input may reach the editor coder.
Execute Aider inside a container or sandbox with no network egress and read-only access to source trees that do not require modification.
Apply application-layer allowlisting on developer endpoints to prevent the Aider process from spawning shells or arbitrary interpreters.

bash

# Configuration example: run Aider in a restricted sandbox
docker run --rm -it \
  --network=none \
  --read-only \
  --tmpfs /tmp \
  --user 1000:1000 \
  -v "$PWD":/src:ro \
  aider-sandbox:0.86.3 \
  aider --no-architect /src