{"id":"CVE-2026-115726","kind":"vulnerability","aliases":["CVE-2026-115726"],"related":[],"title":"Aider: malicious committed config file runs shell commands on developer machines","description":"Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.","summary":"Aider, an AI coding assistant, auto-loads a .aider.conf.yml file from a repository without a trust prompt. An attacker who commits a malicious config can set notifications-command or editor values, which Aider runs through a shell after model replies or /editor use, executing commands with the victim's privileges.","severity":"high","cvss":8.5,"epss":0.00249,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","aider","developers"],"not_affected_if":["not-using-aider","only-trusted-repositories"],"how_to_check":"- Run `aider --version` and compare against the fixed release in the NVD entry; the affected range is through `0.86.2`.\n- Look for a `.aider.conf.yml` in cloned or pulled repositories and check for `notifications-command` or `editor` keys.","fix":"- Upgrade Aider past `0.86.2`; the sources do not name the fixed version, so check the NVD entry or the Aider release notes.\n- Until upgraded, delete or review any `.aider.conf.yml` in untrusted repositories before running Aider in them.","status":"open","published_at":"2026-10-23T12:18:13+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:00:16+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:00:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Aider past `0.86.2`; the sources do not name the fixed version, so check the NVD entry or the Aider release notes.\n- Until upgraded, delete or review any `.aider.conf.yml` in untrusted repositories before running Aider in them.","reach":"local","title":"Aider: malicious committed config file runs shell commands on developer machines","impact":"high","summary":"Aider, an AI coding assistant, auto-loads a .aider.conf.yml file from a repository without a trust prompt. An attacker who commits a malicious config can set notifications-command or editor values, which Aider runs through a shell after model replies or /editor use, executing commands with the victim's privileges.","category":"ai-tooling","nicknames":[],"who_cares":["aider","developers","ai-coding-agent"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker commands run as the developer on their machine","analyst_note":"Check the NVD entry and the Aider project for the fixed version and whether a trust prompt was added; the sources do not give either.","how_to_check":"- Run `aider --version` and compare against the fixed release in the NVD entry; the affected range is through `0.86.2`.\n- Look for a `.aider.conf.yml` in cloned or pulled repositories and check for `notifications-command` or `editor` keys.","needs_analyst":true,"not_affected_if":["not-using-aider","only-trusted-repositories"],"who_is_affected":"Developers who run Aider inside a repository that contains a .aider.conf.yml, including repositories cloned from others or pulled from shared branches, are exposed because the config is loaded without confirmation. Teams that only run Aider on their own repositories with no untrusted commits, or that do not use Aider, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":3332,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115726':14A,17A '-2026':13A,16A '/editor':70B,129C '0.86.2':81C 'agent':21B 'ai':19B,23B,29B 'ai-coding-ag':18B 'ai-tool':22B 'aider':1A,25B,27B,61B,79C 'aider.conf.yml':36B,98C 'allow':88C 'assist':31B 'attack':46B,89C,108C 'auto':33B,102C 'auto-load':32B,101C 'code':20B,30B 'command':8A,56B,73B,84C,93C,113C,132C 'commit':3A,48B,95C 'config':4A,51B 'contain':82C 'cve':12A,15A 'develop':10A,26B 'editor':58B,115C 'execut':72B,85C,119C 'file':5A,37B 'load':34B,103C 'machin':11A 'malici':2A,50B,97C 'model':67B,126C 'notif':55B,112C 'notifications-command':54B,111C 'privileg':78B,137C 'prompt':44B,107C 'repli':68B,127C 'repositori':40B 'run':6A,62B,91C,131C 'set':53B,110C 'shell':7A,65B,92C,123C 'subprocess':121C 'tool':24B 'true':124C 'trust':43B,106C 'use':71B,130C 'valu':59B,116C 'via':120C 'victim':76B,135C 'vulner':86C 'without':41B,104C","nicknames":[],"mitigations":[],"who_affected":"Developers who run Aider inside a repository that contains a .aider.conf.yml, including repositories cloned from others or pulled from shared branches, are exposed because the config is loaded without confirmation. Teams that only run Aider on their own repositories with no untrusted commits, or that do not use Aider, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115726","severity":null,"published_at":"2026-10-23T12:18:13+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115726","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115726","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}