EUVD-2026-25924Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication per the 4.0 vector; scope unchanged and impact limited to partial C/I/A consistent with VC:L/VI:L/VA:L in CVSS 4.0.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aider_mcp_server/server.py of the component aider_ai_code. This manipulation of the argument relative_editable_files causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in disler's aider-mcp-server allows remote unauthenticated attackers to execute arbitrary OS commands by supplying malicious input to the relative_editable_files argument in src/aider_mcp_server/server.py. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and SSVC classifies exploitation as automatable with a public proof-of-concept already published. No vendor patch exists at time of analysis, as the maintainer has not responded to the coordinated disclosure filed in issue #16.
Technical ContextAI
aider-mcp-server is a Model Context Protocol (MCP) server that wraps the Aider AI coding assistant, exposing its file-editing and code-generation capabilities over a network interface to LLM clients. The vulnerable component, aider_ai_code within src/aider_mcp_server/server.py, fails to sanitize the relative_editable_files parameter before passing it to an underlying shell invocation or subprocess call, constituting a CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) injection flaw. The affected codebase is identified by EUVD-2026-25924 at commit b2516fa466d0d851932da92ee6d0e66946db9efc. Because the project uses a rolling release model with no tagged versions, all deployments at or before this commit are affected with no version boundary to filter on.
RemediationAI
No vendor-released patch identified at time of analysis. The maintainer has not responded to issue #16 at https://github.com/disler/aider-mcp-server/issues/16, which served as the coordinated disclosure channel. Organizations currently running this server should immediately restrict its network exposure to localhost or a tightly controlled trusted IP allowlist, as the primary risk vector is network accessibility to untrusted callers. Running the server inside a containerized environment (e.g., Docker with a read-only filesystem and dropped capabilities) limits the impact of successful command injection to the container's scope, though this does not eliminate the vulnerability. Avoid passing any user-controlled or externally sourced values into relative_editable_files if the server must remain operational. Monitor https://github.com/disler/aider-mcp-server/ for a remediation commit and redeploy immediately when one is published.
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today