What happened
Aider through 0.86.2 auto-loads a .aider.conf.yml from the repository without a trust prompt. Values like notifications-command or editor reach a subprocess invoked with shell=True, so a repo-committed config file yields command execution with the user's privileges (CVSS 7.8, CWE-78). Published 2026-10-23.
Why it matters
This is the exact 'agent config = executable instructions' problem: an AI coding agent treating project-supplied configuration as trusted. It lets an attacker who can influence a repo (fork PR, compromised repo, dependency) run code on the developer's machine, including exfiltrating credentials the agent can read.
Attack vector
A malicious .aider.conf.yml committed to a repo is auto-loaded without a trust prompt. The attacker sets notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges. Triggered when the developer runs Aider in the attacker-supplied repo.
Affected systems
Aider (aider-chat) through 0.86.2
Mitigation
Upgrade Aider to a fixed version (fix ships after 0.86.2); treat project-hosted .aider.conf.yml and similar agent config files as executable untrusted input — require explicit opt-in before auto-loading, and audit notifications-command/editor settings. Advisory via VulnCheck.