CVE-2026-115726: A Committed .aider.conf.yml Runs Shell Commands in Aider With No Trust Prompt (Unpatched)

VulnCheck published CVE-2026-115726 on 23 October 2026 (CVSS 4.0 8.5; NVD shows 7.8), credited to Seoyoung Lee. Aider auto-loads .aider.conf.yml from the repository it is started in, with no trust prompt, and because it is built on configargparse every command-line flag is also accepted as a key in that file. A repository can therefore set notifications-command, which Aider runs through subprocess with shell=True after model replies, or editor, which runs when the user invokes /editor, so cloning a repository and working in it with Aider is enough to run the attacker's command with the developer's privileges. The report tested 0.86.2, the latest PyPI release, and the development head; GitHub issue 5885 is still open and no fixed release exists.

You are affected if you run aider-chat 0.86.2 and earlier, including the 0.86.3 development head; no fixed release..

Until Aider ships a fix, do not start Aider in a repository you have not reviewed: check for a .aider.conf.yml first and remove or inspect notifications-command, editor and any other command-valued keys. Run Aider against third-party code only in a container or VM, and alert on aider processes spawning shells. Track Aider-AI/aider issue 5885 for a release.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run aider-chat and which version, then enforce a policy on it.