Is there a public PoC exploit available for CVE-2026-10177?

Yes, a public proof-of-concept exploit is available for CVE-2026-10177. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10177?

Yes, a patch is available for CVE-2026-10177. Update the affected software to the latest version immediately.

Aider-AI Aider CVE-2026-10177

Q: What is the CVSS score of CVE-2026-10177?

CVE-2026-10177 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33497 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-31 VulDB

GHSA-hchg-qm84-cj9p

SSRF Aider Aider Ai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 11:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

May 31, 2026 - 11:01 vuln.today

Analysis Generated

May 31, 2026 - 11:01 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

22 pypi packages depend on aider-chat (22 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.86.2.

DescriptionCVE.org

A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The pull request to fix this issue awaits acceptance.

AnalysisAI

Server-side request forgery in Aider-AI Aider 0.86.3 allows authenticated remote attackers to make the application issue arbitrary HTTP requests to internal network resources, including cloud infrastructure metadata endpoints such as the AWS EC2 instance metadata service at 169.254.169.254. The URL scraping component accepts user-supplied URLs without validating whether the destination resolves to private RFC1918 or link-local address space, enabling an attacker to proxy requests through the Aider host. No public exploit identified at time of analysis meets KEV criteria, but publicly available exploit code exists via GitHub issue #5075, and the upstream fix (PR #5137) awaits formal acceptance into a release.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) arises in Aider's URL scraping subsystem (aider/scrape.py), which uses requests.get and an httpx-based backend to fetch remote web content on behalf of the user. Prior to the fix in PR #5137, the scraper forwarded user-supplied URLs directly to HTTP client calls without resolving the destination hostname and checking whether it maps to a globally routable address. This allows targeting of RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local metadata addresses (169.254.169.254 for AWS EC2 IMDSv1, metadata.google.internal for GCP), and other non-public endpoints. The fix introduces a validate_url() method that resolves DNS and calls is_public_unicast_address() to enforce ip.is_global and not ip.is_multicast and not ip.is_reserved and not ip.is_unspecified, plus a custom ScrapeNetworkBackend that re-validates at TCP connect time to prevent DNS rebinding bypass. The affected CPE is cpe:2.3:a:aider-ai:aider:*:*:*:*:*:*:*:*, indicating all versions are potentially in scope until the fix is formally released.

RemediationAI

Apply the upstream fix from PR #5137 (https://github.com/Aider-AI/aider/pull/5137) once it is merged and a tagged release is cut; a formally released patched version number has not been confirmed in the available data, so monitor the repository for the merge and subsequent release. Users who need an immediate fix can apply the PR diff manually to aider/scrape.py, which introduces DNS-based destination validation and a custom TCP backend that blocks non-global IP addresses at connect time. As a compensating control for cloud-hosted deployments, enforce network egress filtering at the host firewall or cloud security group to block outbound requests from the Aider process to 169.254.0.0/16 (AWS/Azure metadata), 100.100.100.200 (Alibaba Cloud metadata), and all RFC1918 ranges - this prevents SSRF reach to metadata endpoints even if the application-layer fix is not yet applied. Additionally, enforce AWS IMDSv2 (session-oriented token requirement) on any EC2 instance running Aider, which mitigates credential theft via metadata SSRF as a defense-in-depth measure. Trade-off: broad egress filtering may interfere with any legitimate internal HTTP scraping use cases. See VulDB entry https://vuldb.com/vuln/367458 for additional advisory context.