Description

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T15:17:45.597Z",
  "pubdate": "2026-09-04T15:17:45.597Z",
  "executiveSummary": "Aider is susceptible to an arbitrary command execution vulnerability triggered by the insecure handling of configuration files. The application automatically parses a '.aider.conf.yml' file located in the root of a git repository upon initialization.\nThe vulnerability originates from the application's implementation of 'test-cmd' and 'lint-cmd' configuration parameters. These directives are executed using 'subprocess' with 'shell=True' without any user validation or interaction. This allows an attacker who supplies a malicious repository to execute arbitrary system commands on the machine of any user who clones and runs aider within that directory.\nThe impact of this vulnerability is critical, as it allows for full code execution under the privileges of the user running aider. There are no authentication or API requirements for this exploit, as the execution occurs immediately upon startup or the first file edit. This vulnerability is present in current versions, including 0.86.3.dev, and poses a significant risk to developers interacting with untrusted git repositories.",
  "technicalDetails": "The root cause of this vulnerability is the trust model Aider applies to repository-level configuration files. Aider automatically discovers and loads the '.aider.conf.yml' file located in the working directory during its startup sequence. Within this configuration file, the application supports the definition of 'test-cmd' and 'lint-cmd' hooks, which are designed to facilitate automated testing and linting workflows.\nThe exploitation mechanism relies on the insecure invocation of system commands. Aider passes the strings defined in the 'test-cmd' or 'lint-cmd' fields directly to the underlying operating system shell via a Python subprocess call configured with 'shell=True'. Because the application performs no sanitization or confirmation prompts before invoking these commands, an attacker can inject arbitrary shell commands directly into the YAML configuration.\nThe attack flow is straightforward: 1) An attacker creates a git repository containing a maliciously crafted '.aider.conf.yml' file. 2) The attacker sets the 'test-cmd' field to a malicious payload (e.g., a reverse shell or file exfiltration script). 3) The target user clones the repository and initiates the 'aider' tool from within that directory. 4) Upon startup, Aider parses the configuration and executes the defined 'test-cmd' using the current user's shell context. If the 'lint-cmd' is used, the malicious payload is triggered automatically upon the first file edit performed by the LLM or the user within that session.\nThis vulnerability effectively bypasses any expected security boundaries between the tool and the repository content. The subprocess execution inherits the full environment and permissions of the user running the aider process. Given that aider is designed to be run in local development environments, successful exploitation often grants the attacker access to environment variables, credentials, and sensitive source code present on the host machine. The lack of user interaction—no verification of the configuration or confirmation of the command execution—significantly lowers the barrier to entry for potential attackers. This behavior is confirmed to exist in the current development main branch (0.86.3.dev)."
}