EUVD-2026-33496
GHSA-f9g4-qjmq-f49r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
SQL injection in Aider-AI Aider 0.86.3's Code Generation Workflow component allows authenticated remote attackers with low privileges to manipulate internal SQL queries, resulting in partial compromise of confidentiality, integrity, and availability. A publicly available proof-of-concept exploit exists via GitHub issue #5077, raising near-term exploitation risk despite the medium CVSS score of 6.3. The vendor has not yet responded to the responsible disclosure and no patch has been released, leaving users without an official remediation path.
Technical ContextAI
Aider is an open-source AI-powered pair programming CLI tool (aider-ai/aider) that integrates with large language models to assist developers in writing and editing code. It internally uses SQLite for persisting chat history, session context, and project data. The SQL injection vulnerability (CWE-89 - Improper Neutralization of Special Elements used in an SQL Command) is located in the Code Generation Workflow component, indicating that user-controlled input flowing through this workflow is concatenated into SQL statements without proper parameterization or escaping. The affected product is identified via CPE cpe:2.3:a:aider-ai:aider:*:*:*:*:*:*:*:*, with the wildcard version field suggesting the CPE does not bound the vulnerability to a specific narrow range - version 0.86.3 is the confirmed affected release per the VulDB report. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation with low attack complexity and no required user interaction.
RemediationAI
No vendor-released patch is identified at time of analysis. The Aider-AI project has not responded to the responsible disclosure and no fixed version has been published. Users should monitor GitHub issue #5077 (https://github.com/Aider-AI/aider/issues/5077) and the repository (https://github.com/Aider-AI/aider/) for patch availability. As compensating controls, restrict Aider to local or trusted network use only and avoid exposing the Code Generation Workflow to untrusted or externally supplied input, since the attack vector is network-based (AV:N) with low complexity. Consider limiting which users hold even low-level credentials to Aider instances and auditing Aider's SQLite database files for unexpected or anomalous entries. Note that these controls reduce exposure but do not eliminate the underlying vulnerability - applying an official patch when released remains the definitive fix.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted
Protection mechanism failure in Aider-AI Aider 0.86.3 exposes git pre-commit hook bypass via manipulation of the `git-co
Code injection in Aider-AI Aider 0.86.3 Architect Mode enables authenticated remote attackers to execute arbitrary code
Server-side request forgery in Aider-AI Aider 0.86.3 allows authenticated remote attackers to make the application issue
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today