Executive brief
aider is an AI pair programming tool that automatically loads configuration from a .aider.conf.yml file in any git repository. An attacker can craft a malicious repository with commands in the configuration file (test-cmd or lint-cmd) that will execute automatically without user confirmation when a developer clones and runs aider in that repository, leading to complete compromise of the developer's machine.
Technical details
The vulnerability is an arbitrary command execution flaw in aider's configuration loading mechanism. When aider starts, it automatically loads and parses .aider.conf.yml from the git repository root without validating the source or prompting the user. The test-cmd and lint-cmd settings are executed via subprocess with shell=True, allowing arbitrary shell command injection. No authentication, LLM interaction, or API key is required to trigger execution. An attacker can craft a public repository on GitHub or similar platform and socially engineer developers into cloning it, achieving RCE upon running aider. The vulnerability is confirmed in version 0.86.3.dev and has existed long-term.
Affected products
- Aider-AI aider 0.86.3.dev and prior
Timeline
- 2026-09-04: disclosed