Aider automatically loads a .aider.conf.yml file from the root of the repository it is launched in. An attacker can insert a test‑cmd or lint‑cmd entry that aider runs through a shell without user confirmation. Because subprocess is invoked with shell=True, the commands are executed with the privileges of the user running aider. This flaw is a classic command injection (CWE‑94) and allows an attacker to run arbitrary code on the victim’s machine.

The vulnerability affects the Aider‑AI aider project, specifically versions 0.86.2 and the upcoming 0.86.3.dev build. Any environment where aider is executed – Linux, macOS or Windows – is susceptible if the repository contains a crafted .aider.conf.yml file.

The CVSS score of 8.5 indicates high severity, and even though an EPSS score is unavailable, the lack of a KEV listing does not reduce the risk. The attack vector is local: a user who clones an attacker‑supplied repository and runs aider will have their shell commands executed automatically. Since the tool automatically loads the configuration with no prompt or API key, the exploit is trivial for an attacker who can supply a repo and for users who run aider in unknown repositories.