{"schema":"threatline.record/2","record":{"id":"CVE-2026-115726","aliases":[],"summary":"Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings","details":"Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=True after model replies or /editor use, running commands with the victim's privileges.","categories":["Unclassified"],"product":"aider","vendor":"Aider-AI","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115726","source_modified_at":"2026-10-23T11:36:49.084Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"aider","vendor":"Aider-AI","versions":[{"lessThanOrEqual":"0.86.2","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00249,"percentile":0.15338,"score_date":"2026-10-24"},"published_at":"2026-10-23T11:36:49.084Z","modified_at":"2026-10-23T11:36:49.084Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115726","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T11:36:49.084Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115726","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Aider-AI/aider/issues/5885","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/Aider-AI/aider/blob/v0.86.2/aider/io.py#L1088-L1094","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Aider-AI/aider/blob/v0.86.2/aider/editor.py#L89-L134","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Aider-AI/aider/blob/v0.86.2/aider/main.py#L464-L479","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/aider-through-0.86.2-command-execution-via-repository-aider-conf-yml-settings","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T11:36:49.084Z","content_hash":"aa9fd8067222eff49ee4e64dbc93470c828b12f4b1717a3d65a05e4d9810be9f"}}