Is CVE-2026-10175 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10175 being exploited in the wild.

How severe is CVE-2026-10175?

Medium severity, with a CVSS score of 6.3, published 31 May 2026.

Which products and versions are affected?

Aider-AI Aider <= 0.86.2, 0.86.3; aider-chat (PyPI) <= 0.86.2, ECOSYSTEM:introduced=0,last_affected=0.86.2.

Is there a fix for CVE-2026-10175?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10175 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10175?

Check whether you run Aider-AI Aider or aider-chat (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10175: Aider-AI Aider code injection in Architect Mode

Q: Which products and versions are affected?

Aider-AI Aider <= 0.86.2, 0.86.3; aider-chat (PyPI) <= 0.86.2, ECOSYSTEM:introduced=0,last_affected=0.86.2.

Q: Is there a fix for CVE-2026-10175?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-10175 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-10175?

Check whether you run Aider-AI Aider or aider-chat (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10175 · Severity: medium · CVSS 6.3 · Published 2026-05-31

Aider, an AI-powered pair programming tool, is vulnerable to a code injection flaw when using its 'Architect Mode.' An attacker can place malicious instructions inside a project's README or other files; when a user asks the AI to process those files, the AI may be tricked into automatically writing and committing backdoored code into the software project. This could lead to the theft of sensitive information, such as API keys and environment variables, or the introduction of permanent security holes in the user's codebase.

Technologies: Aider-AI Aider. Vendors: Aider-AI, PyPI.

Quick answers

Is CVE-2026-10175 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10175 being exploited in the wild.
How severe is CVE-2026-10175?: Medium severity, with a CVSS score of 6.3, published 31 May 2026.
Which products and versions are affected?: Aider-AI Aider <= 0.86.2, 0.86.3; aider-chat (PyPI) <= 0.86.2, ECOSYSTEM:introduced=0,last_affected=0.86.2.
Is there a fix for CVE-2026-10175?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10175 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10175?: Check whether you run Aider-AI Aider or aider-chat (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Aider (aider-chat) is vulnerable to code injection via a trust-boundary issue in its Architect Mode. In this mode, the 'architect' model's output is passed directly to the 'editor' model via the `editor_coder.run` function with `preproc=False`, bypassing standard input validation and preprocessing layers. An attacker can exploit this by placing 'Architect Override' instructions in repository files (like README.md). When the user invokes Aider to process these files, the architect model may emit malicious code directives that the editor model then applies to the source code. This can result in the exfiltration of `.env` files or the insertion of backdoors, which may be automatically committed if the `--yes` flag is used. As of the advisory date, no official patch has been released.

Affected products

Aider-AI aider-chat <= 0.86.2

Identifiers

CVE-2026-10175
GHSA-7w7m-v5vp-w699
PYSEC-2026-2335

Timeline

2026-04-21: disclosed: Issue reported to the project maintainers via GitHub
2026-05-31: advisory: Initial disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.