CVE-2026-10175

Vulnerability

In Aider-AI Aider version 0.86.3, the editor_coder.run function in auth.py processes output from the architect model without preprocessing (preproc=False), as described in [2]. This allows an attacker to inject malicious code into the project by including hidden instructions (e.g., "ARCHITECT OVERRIDE") in a repository's README.md. The architect model then emits attacker-controlled directives that the editor model applies to files like auth.py, resulting in code injection.

Exploitation

An attacker creates a repository containing a README.md with embedded malicious instructions. When a victim runs Aider in Architect Mode on that repository (e.g., using --yes to skip confirmations), the architect model reads the poisoned README and outputs attacker-controlled code, which the editor model applies directly. No prior authentication or privileges are required by the attacker; the victim only needs to configure Aider to target the attacker's repository. The attack is remote and has been publicly demonstrated with a validated retest [2].

Impact

Successful exploitation allows remote attackers to inject arbitrary code into the victim's project. The documented proof-of-concept exfiltrates the .env file by base64-encoding its contents and sending them to an attacker-controlled endpoint [2]. This compromises confidentiality (secrets disclosure) and integrity (backdoor insertion), with potential for escalation to remote code execution depending on the injected code.

Mitigation

As of the publication date, the vendor has not responded to the issue report and no official fix has been released [1][2]. Users should avoid using Architect Mode with untrusted repositories or those containing unknown content. Until a patch is available, manually review architect suggestions before applying them, especially when using the --yes flag. The project's GitHub repository is at [1] for future updates.