EUVD-2026-33494
GHSA-c3wr-3c4v-6rmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Aider-AI Aider 0.86.3. Affected is an unknown function of the file aider/args.py of the component Pre-commit Hook Handler. Such manipulation of the argument git-commit-verify leads to protection mechanism failure. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Protection mechanism failure in Aider-AI Aider 0.86.3 exposes git pre-commit hook bypass via manipulation of the git-commit-verify argument in aider/args.py, allowing authenticated remote attackers to commit code without triggering pre-commit security controls. The CVSS temporal score includes E:P (proof-of-concept exploit publicly available, linked to GitHub issue #5057), and the vendor has not yet responded to the responsible disclosure. No public KEV listing exists, and the report confidence (RC:R) remains at 'Reasonable' rather than 'Confirmed', indicating the vendor has not acknowledged the finding.
Technical ContextAI
Aider is an AI-assisted terminal coding tool (CPE: cpe:2.3:a:aider-ai:aider:*:*:*:*:*:*:*:*) that integrates with git repositories to make and commit code changes. The vulnerable component is the Pre-commit Hook Handler, specifically argument parsing logic in aider/args.py. CWE-693 (Protection Mechanism Failure) describes scenarios where a product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks. In this case, the git-commit-verify argument - corresponding to git's --no-verify flag equivalent - can be manipulated to suppress execution of pre-commit hooks. Pre-commit hooks are a critical security control layer in git workflows: they enforce linting, secret scanning (e.g., detect-secrets, truffleHog), policy checks, and compliance gates before code is committed. Bypassing this mechanism entirely removes that layer, regardless of what hooks are configured in the repository.
RemediationAI
No vendor-released patch has been identified at time of analysis. The Aider-AI project was notified via GitHub issue #5057 but has not responded. As a compensating control, administrators should restrict access to Aider instances to trusted, authenticated users only, specifically limiting who can invoke Aider with custom argument flags. Where Aider is used in CI/CD pipelines or shared environments, consider enforcing pre-commit hooks at the server-side (e.g., via git server-side pre-receive hooks), which cannot be bypassed by client-side --no-verify equivalent flags - this is the most reliable workaround and has no meaningful side effects. Additionally, configure secret scanning and policy enforcement at the repository hosting layer (GitHub Actions, GitLab CI enforcement) as a defense-in-depth layer independent of client-side hooks. Monitor the GitHub repository at https://github.com/Aider-AI/aider/ and the VulDB entry at https://vuldb.com/vuln/367455 for patch availability.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted
Code injection in Aider-AI Aider 0.86.3 Architect Mode enables authenticated remote attackers to execute arbitrary code
Server-side request forgery in Aider-AI Aider 0.86.3 allows authenticated remote attackers to make the application issue
SQL injection in Aider-AI Aider 0.86.3's Code Generation Workflow component allows authenticated remote attackers with l
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today