Clone-and-run is a research habit. In Aider it is also a shell as soon as the repo root ships the wrong YAML keys.
On 23 October 2026, VulnCheck assigned CVE-2026-115726 to Aider through 0.86.2 for command execution via repository .aider.conf.yml settings. The advisory credits Seoyoung Lee and points at GitHub issue #5885, opened 20 October against Aider-AI/aider.
Repo-root YAML becomes live shell sinks without a trust prompt
Aider builds on configargparse, so command-line flags are also YAML keys. The tool auto-loads .aider.conf.yml from the current working directory, the git repository root, and the home directory. When a user opens an attacker-controlled repository, the attacker's repo-root file supplies live settings with no workspace-trust prompt.
Two keys are the advisory's focus. notifications-command flows into InputOutput; ring_bell runs it with subprocess.run(..., shell=True) after the model replies and on later turns when notifications are enabled. editor flows into pipe_editor, which concatenates the configured editor string with a temporary path and runs it through subprocess.call(..., shell=True) when the user invokes /editor or the matching key binding. Neither path uses the confirmation gate that covers LLM-suggested shell commands.
VulnCheck ships CVE-2026-115726 while 0.86.2 still auto-loads the keys
The issue matters now because coding agents are routinely aimed at freshly cloned repositories, and because this is the same class as earlier test-cmd / lint-cmd exposures with two additional uncovered sinks. VulnCheck rates the advisory High (CVSS 8.5 under its published vector). Lee's end-to-end run on 0.86.2 with a local mock LLM triggered both canaries after ordinary interactive use: one message for notifications, /editor for the editor sink.
Open-source Aider, public issue, advisory dated 23 October
Aider remains an open-source coding agent on PyPI as aider-chat. The public record for this CVE is the VulnCheck advisory dated 23 October 2026 and Aider issue #5885 dated 20 October. Lee tested 0.86.2 and default-branch HEAD described as 0.86.3.dev. Maturity for the security posture on these keys, at advisory time, is still "vulnerable until patched and verified," regardless of how production-shaped teams already find the product for day-to-day editing.
Keep Aider on trusted trees until command keys require an explicit opt-in
Keep Aider on repositories you already trust, or strip command-bearing YAML keys before the first turn. Tools that separate user and home config from repository-local settings, and that require an explicit trust decision before honouring notifications-command, editor, test-cmd, or lint-cmd, are the safer default until a patched release is verified. Until then, treat "open the repo and start chatting" as an unsafe default for untrusted trees.
Auto-load, shell=True, and the earlier test-cmd blind spot stack
The chain is short. Auto-load means the victim never types a malicious command: a single model turn is enough for the notifications sink once the repo-root file is present. Because execution uses shell=True, an editor string with shell metacharacters becomes a command list rather than a single binary path. Teams that previously mitigated test-cmd / lint-cmd still miss these two keys unless they re-inventory the config surface. Impact is arbitrary commands as the user running Aider, including credential theft and follow-on access.
Patch posture and trust prompts are the closer
Watch Aider releases after 0.86.2 for an explicit fix and regression test on repository-local command keys. Until then, the durable control is workspace trust: refuse command-bearing keys from repo-root YAML unless the operator has opted in.