EUVD-2026-26153Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible MCP server with no authentication per CVSS 4.0 PR:N; impacts set Low consistent with reported partial scope of injection into the tool's subprocess context.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of the file aider_mcp.py of the component code_with_ai. The manipulation of the argument working_dir/editable_files leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in eiliyaabedini's aider-mcp MCP server allows remote, unauthenticated attackers to execute arbitrary OS commands by supplying malicious shell metacharacters in the working_dir or editable_files arguments to the code_with_ai function in aider_mcp.py. A public proof-of-concept has been disclosed (SSVC: poc; CVSS 4.0 threat metric E:P), and SSVC classifies the vulnerability as automatable with partial technical impact. No patch exists - the project maintainer was notified via GitHub issue but has not responded, leaving all rolling-release deployments through commit 667b914301aada695aab0e46d1fb3a7d5e32c8af unprotected.
Technical ContextAI
aider-mcp (github.com/eiliyaabedini/aider-mcp) is a Model Context Protocol server that wraps the Aider AI coding assistant, exposing AI-driven code editing capabilities to MCP clients. The vulnerable function code_with_ai in aider_mcp.py accepts working_dir (a filesystem directory) and editable_files (file path list) as caller-supplied arguments and passes them into shell command construction or subprocess invocation without adequate neutralization. CWE-74 (Injection) covers this class of flaw: when user-controlled data is embedded directly into a command or query structure without escaping, attackers can inject additional commands using shell metacharacters such as ;, |, &&, or backticks. No CPE string was provided in the source data; the affected artifact is identified by the GitHub repository commit hash 667b914301aada695aab0e46d1fb3a7d5e32c8af per EUVD-2026-26153.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer was notified via GitHub issue (https://github.com/eiliyaabedini/aider-mcp/issues/1) but has not responded. Because no fixed version exists, the following compensating controls should be applied immediately: first, restrict network access to the aider-mcp server to localhost or a trusted internal network only, eliminating the AV:N attack vector that makes remote exploitation possible; second, audit aider_mcp.py and apply strict allowlist validation on working_dir (restrict to known safe directory paths) and editable_files (reject any input containing shell metacharacters including ;, |, &, $, backticks, or newlines) before those values are passed to any subprocess or shell; third, run the aider-mcp process under a dedicated low-privilege OS account with minimal filesystem permissions to limit blast radius if exploitation occurs. Monitor https://github.com/eiliyaabedini/aider-mcp/ for upstream patch activity and update immediately upon availability.
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today