CVE-2026-10175 - Aider-AI Aider Architect Mode auth.py editor_coder.run code injection

Back Back to CVE browser

MEDIUM

Aider-AI Aider Architect Mode auth.py editor_coder.run code injection

Published May 31, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.24%

Description

A security flaw has been discovered in Aider-AI Aider 0.86.3. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor Aider-AI Product Aider Default
n/a
- Version
  0.86.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Aider-AI

Aider

n/a

Version	Status	Constraints
0.86.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-94

Code Injection

References (8)

https://github.com/Aider-AI/aider
product
https://github.com/Aider-AI/aider/issues/5058
exploitissue-tracking
https://github.com/advisories/GHSA-7w7m-v5vp-w699
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-10175
https://vuldb.com/cve/CVE-2026-10175
third-party-advisory
https://vuldb.com/submit/819909
third-party-advisory
https://vuldb.com/vuln/367456
vdb-entrytechnical-description
https://vuldb.com/vuln/367456/cti
signaturepermissions-required

Link	Providers	Tags
https://github.com/Aider-AI/aider		product
https://github.com/Aider-AI/aider/issues/5058		exploitissue-tracking
https://github.com/advisories/GHSA-7w7m-v5vp-w699		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-10175
https://vuldb.com/cve/CVE-2026-10175		third-party-advisory
https://vuldb.com/submit/819909		third-party-advisory
https://vuldb.com/vuln/367456		vdb-entrytechnical-description
https://vuldb.com/vuln/367456/cti		signaturepermissions-required