{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-115726",
    "name": "CVE-2026-115726",
    "vendor": "aider-chat",
    "description": "VulnCheck published CVE-2026-115726 on 23 October 2026 (CVSS 4.0 8.5; NVD shows 7.8), credited to Seoyoung Lee. Aider auto-loads .aider.conf.yml from the repository it is started in, with no trust prompt, and because it is built on configargparse every command-line flag is also accepted as a key in that file. A repository can therefore set notifications-command, which Aider runs through subprocess with shell=True after model replies, or editor, which runs when the user invokes /editor, so cloning a repository and working in it with Aider is enough to run the attacker's command with the developer's privileges. The report tested 0.86.2, the latest PyPI release, and the development head; GitHub issue 5885 is still open and no fixed release exists.",
    "website": "https://www.vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-settings",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-10-23",
    "risk": {
      "score": 85,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-115726",
      "aliases": [
        "ti-152"
      ],
      "title": "CVE-2026-115726: A Committed .aider.conf.yml Runs Shell Commands in Aider With No Trust Prompt (Unpatched)",
      "summary": "VulnCheck published CVE-2026-115726 on 23 October 2026 (CVSS 4.0 8.5; NVD shows 7.8), credited to Seoyoung Lee. Aider auto-loads .aider.conf.yml from the repository it is started in, with no trust prompt, and because it is built on configargparse every command-line flag is also accepted as a key in that file. A repository can therefore set notifications-command, which Aider runs through subprocess with shell=True after model replies, or editor, which runs when the user invokes /editor, so cloning a repository and working in it with Aider is enough to run the attacker's command with the developer's privileges. The report tested 0.86.2, the latest PyPI release, and the development head; GitHub issue 5885 is still open and no fixed release exists.",
      "severity": "high",
      "cvss": {
        "score": 8.5,
        "vector": null,
        "version": "4.0"
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "agent",
      "component": {
        "name": "aider-chat",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/aider"
      },
      "affected": [
        {
          "range": "aider-chat 0.86.2 and earlier, including the 0.86.3 development head; no fixed release.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-23",
      "modifiedAt": "2026-10-23",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://www.vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-settings"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115726"
        }
      ],
      "mitigation": "Until Aider ships a fix, do not start Aider in a repository you have not reviewed: check for a .aider.conf.yml first and remove or inspect notifications-command, editor and any other command-valued keys. Run Aider against third-party code only in a container or VM, and alert on aider processes spawning shells. Track Aider-AI/aider issue 5885 for a release.",
      "detectedByAnomity": true
    }
  }
}