CVE-2026-10175: Code Injection in Aider-AI Aider 0.86.3 – Exploit Available

Technical summary

CVE-2026-10175 is a code injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output, CWE-94: Improper Control of Generation of Code) affecting the Architect Mode component in Aider-AI Aider 0.86.3. The vulnerability resides in the editor_coder.run function within auth.py, where insufficient input sanitization allows authenticated attackers to inject malicious code that executes in the application context. The attack vector is network-based and does not require user interaction beyond initial authentication. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the authentication requirement and the scope limitation, though the impact includes confidentiality, integrity, and availability compromise.

Business impact

For organizations leveraging Aider as an AI-assisted development tool, this vulnerability creates insider risk and supply-chain concerns. Compromised developer environments can lead to malicious code injection into codebases, intellectual property theft, and lateral movement within networks. While exploitation requires valid credentials, the availability of public exploits accelerates the timeline to active attacks, especially against less-monitored development infrastructure. Teams relying on Aider for production code generation should treat this as a priority containment issue.

Affected systems

Aider-AI Aider version 0.86.3 is confirmed vulnerable. The vulnerability is specific to Architect Mode and the editor_coder.run function, suggesting that instances running this component with active user authentication are directly at risk. Other versions have not been evaluated in the advisory data provided; verify compatibility across your deployment versions against the vendor's updated security guidance.

Exploitability

The vulnerability is exploitable remotely over the network by any user with valid authentication credentials. Public exploit code is now available, removing significant barriers to weaponization. The low complexity of the attack (AC:L in the CVSS vector) and absence of required user interaction (UI:N) mean that once an attacker has credentials—whether through credential compromise, insider access, or compromised accounts—exploitation is straightforward and can be automated. This dramatically raises the risk profile despite the MEDIUM severity rating.

Remediation

Immediate action is required: (1) Isolate or disable Aider 0.86.3 instances, particularly in Architect Mode, until a patched version is available. (2) Review and rotate credentials for all accounts with access to Aider installations. (3) Monitor for suspicious activity on systems running vulnerable versions, including unexpected code changes or system commands executed through the editor_coder function. (4) Contact Aider-AI through their security reporting channels to accelerate patch development—the project has been notified but has not yet responded.

Patch guidance

As of the modification date (2026-06-17), no vendor patch has been released or documented. Verify the Aider-AI GitHub repository and official security advisories for updated versions beyond 0.86.3. In the interim, consider implementing network-level access controls to limit who can reach Aider instances, disabling Architect Mode if feasible, and enforcing code review processes to detect injected malicious code. When a patched version is released, prioritize deployment in your development environments.

Detection guidance

Monitor auth.py and editor_coder.run function calls for suspicious arguments or unexpected code patterns, particularly in Architect Mode sessions. Log all authentication events and code generation requests with full payloads. Search historical logs for evidence of code injection attempts or unusual character sequences in editor commands. Implement runtime detection for unexpected process spawning or system command execution originating from Aider processes. Correlate failed authentication attempts followed by successful logins, which may indicate credential compromise preceding exploitation.

Why prioritize this

Although the CVSS score is MEDIUM, this vulnerability warrants high-priority action due to (1) active public exploits already in the wild, (2) the direct path to arbitrary code execution in development environments, (3) lack of vendor response and available patches, and (4) the potential for supply-chain impact if development toolchains are compromised. Organizations with Aider 0.86.3 deployed should treat this as an urgent containment matter.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects the authentication requirement (PR:L) and single-user scope (S:U), which moderates an otherwise severe code injection flaw. However, the score does not fully capture the business risk: public exploit availability, the lack of patches, and the strategic value of compromising development infrastructure elevate the practical risk beyond the numerical rating. Security leaders should interpret this as a gap between CVSS scoring and operational urgency.

Frequently asked questions