# CVE-2026-115726: CVE-2026-115726: A Committed .aider.conf.yml Runs Shell Commands in Aider With No Trust Prompt (Unpatched)

> CVE-2026-115726 is a high-severity remote code execution issue (CVSS 4.0 8.5) in aider-chat, an AI agent. Affected: aider-chat 0.86.2 and earlier, including the 0.86.3 development head; no fixed release..

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-115726
- **Aliases:** ti-152
- **Severity:** high
- **CVSS:** 8.5 (v4.0)
- **Attack type:** Remote code execution
- **Component:** aider-chat (AI agent)
- **Catalog entry:** https://catalog.anomity.ai/agent/aider
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-23
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-115726

## Summary

VulnCheck published CVE-2026-115726 on 23 October 2026 (CVSS 4.0 8.5; NVD shows 7.8), credited to Seoyoung Lee. Aider auto-loads .aider.conf.yml from the repository it is started in, with no trust prompt, and because it is built on configargparse every command-line flag is also accepted as a key in that file. A repository can therefore set notifications-command, which Aider runs through subprocess with shell=True after model replies, or editor, which runs when the user invokes /editor, so cloning a repository and working in it with Aider is enough to run the attacker's command with the developer's privileges. The report tested 0.86.2, the latest PyPI release, and the development head; GitHub issue 5885 is still open and no fixed release exists.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| aider-chat 0.86.2 and earlier, including the 0.86.3 development head; no fixed release. | no fixed version listed |

## Am I affected by CVE-2026-115726?

You are affected if you run aider-chat 0.86.2 and earlier, including the 0.86.3 development head; no fixed release..

## How do I fix CVE-2026-115726?

Until Aider ships a fix, do not start Aider in a repository you have not reviewed: check for a .aider.conf.yml first and remove or inspect notifications-command, editor and any other command-valued keys. Run Aider against third-party code only in a container or VM, and alert on aider processes spawning shells. Track Aider-AI/aider issue 5885 for a release.

## How do I find every machine running aider-chat?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run aider-chat and which version, then enforce a policy on it.

## References

- advisory: https://www.vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-settings
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-115726

## Related vulnerabilities

- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [GHSA-632h-h47v-g4x4](https://catalog.anomity.ai/vuln/ghsa-632h-h47v-g4x4) — high
- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and](https://catalog.anomity.ai/vuln/openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and) — high
- [CVE-2026-82533](https://catalog.anomity.ai/vuln/cve-2026-82533) — critical
- [CVE-2026-72718](https://catalog.anomity.ai/vuln/cve-2026-72718) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-115726