Aider EUVD-2026-108714

Exploitation requires the victim to run Aider (version ≤0.86.2) inside a directory/repository containing an attacker-controlled .aider.conf.yml, which Aider auto-loads without any trust prompt. The specific exploitable settings are the 'notifications-command' and 'editor' configuration values, which are passed to subprocess with shell=True. Execution is triggered when the victim receives a model reply (for notifications-command) or invokes /editor use (for editor) - so the limiting factors are: (1) the victim must open and operate Aider within the hostile repo (passive user interaction, UI:P), and (2) the relevant feature/command path must be reached. No attacker authentication or elevated privileges are needed; commands run with the victim's own privileges.

This is a genuine but conditionally-gated code execution flaw (CWE-78) rather than a mass-exploitable network vulnerability. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) correctly characterizes it as locally-vectored with passive user interaction, no privileges required, and high confidentiality/integrity/availability impact to the victim's account - consistent with the description: a malicious .aider.conf.yml auto-loaded from a repository runs attacker-controlled notifications-command/editor values via subprocess shell=True. The vuln.today decision label is 'this_week' (a priority signal, not an emergency), and the flaw was reported by VulnCheck. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of widespread automated exploitation; the attack requires a victim to run Aider inside an attacker-supplied repository, making this better suited to targeted supply-chain / social-engineering scenarios than opportunistic mass exploitation. Note a tension to verify: PR:N (no privileges) is accurate for the attacker, but exploitation is entirely contingent on the victim opening a hostile repo and then triggering a model reply or /editor use, so raw score should be read alongside that interaction requirement. EPSS and KEV are absent (not necessarily low - simply not provided), so prioritization rests on the this_week label, VulnCheck attribution, and the public issue/advisory references.

An attacker publishes a repository (or submits a pull request / shares a project) containing a crafted .aider.conf.yml that sets notifications-command or editor to a shell payload. When a developer opens that repository and runs Aider, the config is auto-loaded with no trust prompt, and the payload executes via subprocess with shell=True after the first model reply or when /editor is used, running with the victim's privileges. A public PoC reference exists (GitHub issue #5885 and a VulnCheck advisory); it is not verified as working exploit code.