Executive brief
Aider, an AI-powered pair programming tool, is vulnerable to a code injection flaw when using its 'Architect Mode.' An attacker can place malicious instructions inside a project's README or other files; when a user asks the AI to process those files, the AI may be tricked into automatically writing and committing backdoored code into the software project. This could lead to the theft of sensitive information, such as API keys and environment variables, or the introduction of permanent security holes in the user's codebase.
Technical details
Aider (aider-chat) is vulnerable to code injection via a trust-boundary issue in its Architect Mode. In this mode, the 'architect' model's output is passed directly to the 'editor' model via the `editor_coder.run` function with `preproc=False`, bypassing standard input validation and preprocessing layers. An attacker can exploit this by placing 'Architect Override' instructions in repository files (like README.md). When the user invokes Aider to process these files, the architect model may emit malicious code directives that the editor model then applies to the source code. This can result in the exfiltration of `.env` files or the insertion of backdoors, which may be automatically committed if the `--yes` flag is used. As of the advisory date, no official patch has been released.
Affected products
- Aider-AI aider-chat <= 0.86.2
Timeline
- 2026-04-21: disclosed: Issue reported to the project maintainers via GitHub
- 2026-05-31: advisory: Initial disclosure and CVE assignment