Aider through 0.86.2 contains a command execution flaw that enables an attacker to run arbitrary shell commands on the machine running Aider. The attacker creates a malicious .aider.conf.yml file in a repository; because the file is auto‑loaded without a trust prompt, the application passes configured values such as notifications-command or editor directly to subprocess with shell=True. When the model replies or the /editor command is used, these values are executed, giving the attacker the privileges of the Aider process.

The vulnerability affects the Aider-AI Aider product version 0.86.2. Only this specific release is known to be exploitable. No other versions are listed as impacted.

The CVSS score of 8.5 indicates a high severity vulnerability. EPSS is not reported, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to commit a crafted .aider.conf.yml file to a repository that the target user accesses. Once the configuration is loaded, the attacker can execute arbitrary commands with the victim’s user privileges, potentially compromising the entire system and any services running under those credentials.