---
id: CVE-2026-85674
title: >-
  aider (aider-chat) automatically loads a .aider.conf.yml configuration file
  from the root of the git repository it is launched in
summary: >-
  aider (aider-chat) automatically loads a .aider.conf.yml configuration file
  from the root of the git repository it is launched in. A crafted repository
  can set test-cmd (executed at startup) or lint-cmd (executed on the first file
  edit),…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: Aider-AI
product: aider
affected:
  - aider <= 0.86.2
published: '2026-09-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:18:00.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85674'
references:
  - url: 'https://github.com/Aider-AI/aider'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Aider-AI/aider/blob/v0.86.2/aider/main.py'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Aider-AI/aider/issues/5254'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/aider-0.86.2-remote-code-execution-via-aider-conf-yml
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T14:24:58.286647Z'
ingestedAt: '2026-09-13T11:07:10.924Z'
epss: 0.00249
epssPercentile: 0.14367
---

## Overview

aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.