The vulnerability is a command injection flaw in the aide_ai_code server.py module of the aider-mcp-server application. An attacker can supply a specially crafted relative_editable_files argument that causes the server to execute arbitrary shell commands. This flaw allows remote exploitation without authentication and has an available exploit published publicly. If exploited, an attacker could gain full control over the host running the service, compromise confidentiality, integrity, and availability, and use the system to pivot to other assets.

This issue affects instances of the Disler aider-mcp-server product built from source code up to and including the commit b2516fa466d0d851932da92ee6d0e66946db9efc. The project follows a rolling‑release model, so any deployment built from an unpatched commit is vulnerable until a new release that removes the flaw is published.

The CVSS score of 6.9 classifies the risk as medium, but the availability of a public exploit and the absence of a hardening barrier raise the practical threat. EPSS is 1%, indicating a low but non‑zero exploit probability, and the vulnerability is not listed in CISA's KEV catalogue. Based on the description, the likely attack vector is a remote HTTP endpoint that accepts user input in the relative_editable_files parameter. An attacker can remotely trigger the injection by sending a crafted request, regardless of authentication, making this a high‑impact vulnerability for exposed services.