CVE-2026-85674: aider-chat RCE Vulnerability

CVE-2026-85674 Overview

CVE-2026-85674 is a code injection vulnerability [CWE-94] in aider (aider-chat), an AI-assisted coding tool. The tool automatically loads a .aider.conf.yml file from the root of the git repository where it is launched. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit). Aider passes these values to a subprocess with shell=True without user confirmation, LLM interaction, or API key. Cloning and running aider inside an attacker-controlled repository yields arbitrary command execution on the developer's machine. The behavior was confirmed on version 0.86.3.dev (current main).

Critical Impact

Arbitrary command execution on a developer workstation triggered simply by running aider inside a malicious repository.

Affected Products

• aider (aider-chat) version 0.86.2
• aider (aider-chat) version 0.86.3.dev (main branch at time of confirmation)
• Earlier aider releases that support .aider.conf.yml auto-loading

Discovery Timeline

• 2026-09-04 - CVE-2026-85674 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85674

Vulnerability Analysis

Aider is a command-line AI pair-programming assistant that reads configuration from a .aider.conf.yml file located in the working directory or git repository root. Two directives inside this file, test-cmd and lint-cmd, are designed to invoke developer tooling. Aider executes both directives through a shell subprocess using shell=True, which interprets arbitrary shell metacharacters.

An attacker publishes a git repository containing a malicious .aider.conf.yml. When a victim clones the repository and launches aider inside it, test-cmd runs at startup. If startup execution is avoided, lint-cmd runs the first time aider edits a file. Neither path prompts the user, requires an LLM response, nor requires a configured API key.

Root Cause

The root cause is unsafe execution of untrusted configuration data. Aider treats repository-local configuration as trusted input and passes the test-cmd and lint-cmd values directly to a shell interpreter. There is no allow-list, no signature check, and no user prompt before execution. This pattern maps to CWE-94 (Improper Control of Generation of Code).

Attack Vector

Exploitation requires local user interaction: the victim must clone or open an attacker-controlled repository and run the aider command inside it. This is a realistic supply-chain scenario for developers who evaluate third-party projects. The malicious YAML file lives in the repository root and is loaded automatically, so no additional flag or manual configuration is needed to trigger the payload.

The vulnerability mechanism is straightforward: a YAML key such as test-cmd or lint-cmd holds a shell string, and aider forwards that string to subprocess with shell=True. See the VulnCheck Aider RCE Advisory and GitHub Aider Issue #5254 for technical details.

Detection Methods for CVE-2026-85674

Indicators of Compromise

• Presence of .aider.conf.yml at the root of any cloned repository containing test-cmd or lint-cmd keys with unexpected shell payloads.
• Child processes of aider (or python running aider/main.py) spawning shells such as /bin/sh -c, bash -c, or cmd.exe /c with commands unrelated to project tests or linters.
• Outbound network connections initiated by processes descended from aider shortly after repository clone.

Detection Strategies

• Alert on process trees where aider is the parent of sh, bash, zsh, powershell.exe, or cmd.exe executing scripts, downloaders (curl, wget), or interpreters with inline payloads.
• Perform static scanning of newly cloned repositories for .aider.conf.yml files and flag test-cmd or lint-cmd values containing pipes, redirects, &&, ;, base64 blobs, or network utilities.
• Correlate file-write events for .aider.conf.yml in developer home directories with subsequent execution of aider.

Monitoring Recommendations

• Log command-line arguments for all child processes of aider on developer endpoints to preserve forensic evidence.
• Monitor developer workstations for unexpected outbound connections, credential-store access (SSH keys, .aws/credentials, browser data) immediately following aider launches.
• Track installations and version updates of the aider-chat package via endpoint software inventory.

How to Mitigate CVE-2026-85674

Immediate Actions Required

• Do not run aider inside untrusted repositories until a patched release is installed and verified.
• Inspect every cloned repository for .aider.conf.yml and review the test-cmd and lint-cmd values before executing aider.
• Restrict developer workstations from executing repository-supplied shell commands automatically, using endpoint policy or containerized development environments.

Patch Information

At the time of writing, no fixed version is referenced in the NVD entry. Track the GitHub Aider AI Repository and GitHub Aider Issue #5254 for a fixed release. Upgrade to the patched version as soon as it is published, and confirm the release notes explicitly address .aider.conf.yml command execution.

Workarounds

• Delete or rename any .aider.conf.yml file present in a repository before running aider.
• Launch aider from an empty scratch directory with --no-git or with an explicit configuration path that you control.
• Run aider inside a disposable virtual machine or container so any command execution is contained to an ephemeral environment.
• Configure endpoint controls to block interactive shells spawned by aider from executing high-risk binaries such as curl, wget, nc, and shell interpreters with inline scripts.

# Configuration example: audit and neutralize .aider.conf.yml before launching aider
find . -name '.aider.conf.yml' -maxdepth 2 -print
mv .aider.conf.yml .aider.conf.yml.disabled 2>/dev/null
aider --no-auto-lint --no-auto-test