Is CVE-2026-10174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10174 being exploited in the wild.

How severe is CVE-2026-10174?

Medium severity, with a CVSS score of 6.3, published 31 May 2026.

Is there a fix for CVE-2026-10174?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10174 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10174?

Check whether you run Aider-AI Aider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10174: Aider-AI Aider protection mechanism failure in Pre-commit Hook Handler

CVE-2026-10174 · Severity: medium · CVSS 6.3 · Published 2026-05-31

Aider, an AI-powered pair programming tool, contains a configuration flaw where it automatically bypasses security checks (pre-commit hooks) when saving code changes to a repository. These hooks are often used by organizations to prevent the accidental upload of sensitive data like passwords or insecure code patterns. Because these protections are disabled by default, an attacker or an automated AI suggestion could introduce vulnerabilities or leak secrets into a codebase without being stopped by standard security filters.

Technologies: Aider-AI Aider. Vendors: Aider-AI.

Quick answers

Is CVE-2026-10174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10174 being exploited in the wild.
How severe is CVE-2026-10174?: Medium severity, with a CVSS score of 6.3, published 31 May 2026.
Which products and versions are affected?: Aider-AI Aider 0.86.3.
Is there a fix for CVE-2026-10174?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10174 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10174?: Check whether you run Aider-AI Aider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Aider-AI Aider 0.86.3 due to the default configuration of the 'git-commit-verify' argument in 'aider/args.py'. The application defaults this value to 'False', which causes the 'Pre-commit Hook Handler' in 'aider/repo.py' to append the '--no-verify' flag to git commit commands. This behavior effectively bypasses repository-level security controls, including secret scanning, static analysis, and custom SDLC policy enforcement hooks. An attacker or a malicious AI-generated PR could exploit this to commit insecure code or sensitive credentials that would otherwise be blocked by the local environment's security hooks. As of the advisory date, the project has not yet released a patch to change this default behavior.

Affected products

Aider-AI Aider 0.86.3

Timeline

2026-04-21: disclosed: Issue reported to the Aider-AI GitHub repository
2026-05-31: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.