aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs through a shell (subprocess with shell=True) without any user confirmation, LLM interaction, or API key. Consequently, a user who clones and runs aider inside an attacker-supplied repository achieves arbitrary command execution on their machine. The behavior is long-standing and was confirmed on 0.86.3.dev (current main).

A critical arbitrary command execution vulnerability exists in aider (aider-chat), an AI-powered coding assistant. The tool automatically loads a .aider.conf.yml configuration file from the root of any git repository it is launched in. An attacker can craft a malicious repository with test-cmd or lint-cmd directives that execute arbitrary shell commands via subprocess with shell=True. These commands run without any user confirmation, LLM interaction, or API key requirement. A victim simply needs to clone and run aider inside the attacker-controlled repository to trigger code execution. The vulnerability is long-standing and was confirmed on version 0.86.3.dev. This represents a significant supply chain and developer tooling risk, especially given the growing adoption of AI coding assistants.