Is CVE-2026-85674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85674 being exploited in the wild.

How severe is CVE-2026-85674?

High severity, with a CVSS score of 7.8, published 4 September 2026.

Which products and versions are affected?

Aider-AI Aider 0.86.3.dev and prior.

Is there a fix for CVE-2026-85674?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85674 attacked?

It is attacked with local access.

Am I affected by CVE-2026-85674?

Check whether you run Aider-AI Aider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85674: aider arbitrary command execution via .aider.conf.yml configuration file

CVE-2026-85674 · Severity: high · CVSS 7.8 · Published 2026-09-04

aider is an AI pair programming tool that automatically loads configuration from a .aider.conf.yml file in any git repository. An attacker can craft a malicious repository with commands in the configuration file (test-cmd or lint-cmd) that will execute automatically without user confirmation when a developer clones and runs aider in that repository, leading to complete compromise of the developer's machine.

Technologies: Aider-AI Aider. Vendors: Aider-AI.

Quick answers

Is CVE-2026-85674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85674 being exploited in the wild.
How severe is CVE-2026-85674?: High severity, with a CVSS score of 7.8, published 4 September 2026.
Which products and versions are affected?: Aider-AI Aider 0.86.3.dev and prior.
Is there a fix for CVE-2026-85674?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85674 attacked?: It is attacked with local access.
Am I affected by CVE-2026-85674?: Check whether you run Aider-AI Aider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an arbitrary command execution flaw in aider's configuration loading mechanism. When aider starts, it automatically loads and parses .aider.conf.yml from the git repository root without validating the source or prompting the user. The test-cmd and lint-cmd settings are executed via subprocess with shell=True, allowing arbitrary shell command injection. No authentication, LLM interaction, or API key is required to trigger execution. An attacker can craft a public repository on GitHub or similar platform and socially engineer developers into cloning it, achieving RCE upon running aider. The vulnerability is confirmed in version 0.86.3.dev and has existed long-term.

Affected products

Aider-AI aider 0.86.3.dev and prior

Timeline

2026-09-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.