On 4 September 2026, VulnCheck published CVE-2026-85674 for aider, the terminal-based AI pair programmer distributed on PyPI as aider-chat. Aider automatically loads a .aider.conf.yml file from the root of the Git repository it starts in, and a crafted repository can use that file to set test-cmd or lint-cmd, which aider runs through a shell without asking. Opening someone else's repository with aider can run their commands on your machine.
What's affected
- Package:
aider-chat(aider), all versions with repository-root config loading. The NVD record calls the behavior "long-standing" and says it was confirmed on 0.86.3.dev, the main branch at the time of the report. VulnCheck lists 0.86.2 and earlier as affected and credits George Chen. - Severity: CVSS 4.0 8.5, CVSS 3.1 7.8 (local attack vector, user interaction required).
- Trigger: per NVD,
test-cmdis "executed at startup" andlint-cmdruns "on the first file edit." Aider runs them withsubprocessandshell=True, "without any user confirmation, LLM interaction, or API key." - Fix status: none released. The upstream issue, Aider-AI/aider #5254, was opened on 12 June 2026 and was still open when we checked on 18 October. Two linked pull requests were also open.
Aider's documentation explains why this works. It looks for .aider.conf.yml in your home directory, the root of your git repo and the current directory, and "files loaded last will take priority." A repository-level file overrides your home-directory settings. Auto-lint is on by default.
How to check if you're exposed
Before starting aider in any repository you didn't write, look for a config file and for the keys that run commands:
ls -la .aider.conf.yml 2>/dev/null
grep -nE '^\s*(test-cmd|lint-cmd|auto-test|auto-lint)\s*:' .aider.conf.yml 2>/dev/null
To sweep every repository under a directory:
find ~/src -name .aider.conf.yml -not -path '*/node_modules/*' 2>/dev/null \
| xargs grep -lE '^\s*(test-cmd|lint-cmd)\s*:' 2>/dev/null
Each hit is a command aider would run for you. Read it the way you'd read a shell script someone emailed you.
Check which version you have, so you can track the fix when it lands:
pip show aider-chat 2>/dev/null | grep -i '^version'
aider --version
What to do now
-
Point aider at your own config. Aider's docs say passing a config file path "will only load the one config file," which skips the repository search:
aider --config ~/.aider.conf.ymlA shell alias makes this the default:
alias aider='aider --config ~/.aider.conf.yml' -
Inspect
.aider.conf.ymlin third-party repos before running aider there, using the grep above. -
Run untrusted repositories in a container without your SSH keys, cloud credentials or model API keys mounted. The command runs as you, so it can read anything you can.
-
Add the file to code review rules. A pull request that adds or changes
.aider.conf.ymlwith a command key should get the same scrutiny as a CI workflow change. -
Follow issue #5254 and upgrade once a release changes how repository config is trusted.
Why it matters
Project-level config for developer tools is convenient and dangerous for the same reason: it lets a repository decide how your tools behave. When one of those settings is "run this shell command," the repository is choosing code to execute on your machine.
AI coding tools have adopted this pattern quickly. Aider's .aider.conf.yml belongs to the same family as the Git config entries in this year's Codex CVEs and the workspace settings in the Kiro advisories. The fix in each case is to separate settings that change preferences from settings that run programs, and to ask before trusting the second kind.
Until aider ships that separation, the safest habit is simple: run aider with your own config file and treat any repo-supplied command as untrusted input.
Try it yourself
Write a small policy for your repositories that fails a pull request when .aider.conf.yml gains a test-cmd or lint-cmd line, and try it against a test branch. Then see how pull request gates apply checks like that automatically.
Click through it at your own pace, or open it full screen.
Quick check
Does the attack need my model API key or a prompt?
No. NVD says the commands run without user confirmation, LLM interaction or an API key. Starting aider in the repository is enough for test-cmd.
Does my home-directory config protect me?
Not on its own. Aider loads home, repository root and current directory configs in that order, and later files take priority. Passing your own config file explicitly is what stops the repository file from loading.
Is there a patched version to install?
Not yet. Issue #5254 was still open on 18 October 2026, and the NVD record describes the behavior on the current main branch.
