EUVD-2026-33495
GHSA-7w7m-v5vp-w699
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3Blast Radius
ecosystem impact- 22 pypi packages depend on aider-chat (22 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.86.2.
DescriptionCVE.org
A security flaw has been discovered in Aider-AI Aider 0.86.3. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Code injection in Aider-AI Aider 0.86.3 Architect Mode enables authenticated remote attackers to execute arbitrary code via the editor_coder.run function in auth.py. A public proof-of-concept exploit is available via GitHub issue #5058, lowering the barrier to exploitation. No vendor patch exists as the project has not responded to the responsible disclosure, leaving all users of the affected version exposed with no official remediation path.
Technical ContextAI
Aider is an AI-powered coding assistant that supports an 'Architect Mode,' a multi-agent workflow where a planning model delegates code edits to a secondary editor model. The vulnerability resides in the editor_coder.run function within auth.py and is classified as CWE-94 (Improper Control of Generation of Code, also known as Code Injection). This class of flaw occurs when user-supplied or externally influenced input is incorporated into dynamically evaluated code without adequate sanitization or sandboxing. In the context of an AI coding tool, the attack surface is notable because Architect Mode is designed to process and execute instructions - a design pattern that may blur the line between legitimate code generation and malicious injection. The affected CPE (cpe:2.3:a:aider-ai:aider:*:*:*:*:*:*:*:*) uses a wildcard version field, suggesting the NVD entry may reflect uncertainty about the full version scope beyond the explicitly named 0.86.3.
RemediationAI
No vendor-released patch identified at time of analysis - the Aider-AI project was notified via an issue report (https://github.com/Aider-AI/aider/issues/5058) but has not responded or issued a fix. Until a patch is available, the primary compensating control is to disable or avoid using Architect Mode, which is the specific feature exposing the vulnerable editor_coder.run code path; disabling this mode eliminates the known attack surface but removes multi-agent planning functionality. If Aider must remain operational, restrict authenticated access strictly to trusted users and avoid exposing Aider instances over a network - running it exclusively in local, single-user environments reduces the AV:N attack vector to a practical AV:L exposure. Monitor the GitHub repository (https://github.com/Aider-AI/aider/) and VulDB entry (https://vuldb.com/vuln/367456) for any vendor response or patch release. Organizations using Aider in CI/CD pipelines should audit whether Architect Mode is invoked and consider disabling it in pipeline configurations until a fix is confirmed.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted
Protection mechanism failure in Aider-AI Aider 0.86.3 exposes git pre-commit hook bypass via manipulation of the `git-co
Server-side request forgery in Aider-AI Aider 0.86.3 allows authenticated remote attackers to make the application issue
SQL injection in Aider-AI Aider 0.86.3's Code Generation Workflow component allows authenticated remote attackers with l
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today