CVE-2026-10175

MEDIUM

Aider-AI Aider Architect Mode auth.py editor_coder.run code injection

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in Aider-AI Aider 0.86.3. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-367456 | Aider-AI Aider Architect Mode auth.py editor_coder.run code injection
https://vuldb.com/vuln/367456
Signature, Permissions Required signature permissions-required
VDB-367456 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/367456/cti
Third Party Advisory third-party-advisory
CVE-2026-10175 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10175
Third Party Advisory third-party-advisory
Submit #819909 | paul-gauthier aider 0.86.3 Code Injection
https://vuldb.com/submit/819909
Exploit exploit issue-tracking
https://github.com/Aider-AI/aider/issues/5058

Scores

CVSS v3 6.3
EPSS 0.0024
EPSS Percentile 14.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-94
Status published
Products (1)
Aider-AI/Aider 0.86.3
Published May 31, 2026
Tracked Since May 31, 2026