Live › vulnerability › CVE-2026-115726
Go to dashboardAider, an AI coding assistant, auto-loads a .aider.conf.yml file from a repository without a trust prompt. An attacker who commits a malicious config can set notifications-command or editor values, which Aider runs through a shell after model replies or /editor use, executing commands with the victim's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Developers who run Aider inside a repository that contains a .aider.conf.yml, including repositories cloned from others or pulled from shared branches, are exposed because the config is loaded without confirmation. Teams that only run Aider on their own repositories with no untrusted commits, or that do not use Aider, can skip it.
No product ranges from the sources yet.
aider --version and compare against the fixed release in the NVD entry; the affected range is through 0.86.2..aider.conf.yml in cloned or pulled repositories and check for notifications-command or editor keys.0.86.2; the sources do not name the fixed version, so check the NVD entry or the Aider release notes..aider.conf.yml in untrusted repositories before running Aider in them.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-115726")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.