Summary
Aider through version 0.86.2 can execute attacker-controlled shell commands from a malicious .aider.conf.yml file that is automatically loaded without a trust prompt. If a victim opens a project containing this configuration, commands configured through notification or editor settings may run with the victim's privileges after model responses or editor actions.
Aider through version 0.86.2 can execute attacker-controlled shell commands from a malicious .aider.conf.yml file that is automatically loaded without a trust prompt. If a victim opens a project containing this configuration, commands configured through notification or editor settings may run with the victim's privileges after model responses or editor actions.
Affected context
The vulnerability occurs when Aider automatically loads project-level .aider.conf.yml configuration without clearly establishing that the file is trusted. Risk is present when configuration values such as notifications-command or editor settings are later passed to process execution using shell interpretation. The impact depends on whether a victim opens or operates on an untrusted project and what privileges are available to the Aider process.
The vulnerability occurs when Aider automatically loads project-level .aider.conf.yml configuration without clearly establishing that the file is trusted. Risk is present when configuration values such as notifications-command or editor settings are later passed to process execution using shell interpretation. The impact depends on whether a victim opens or operates on an untrusted project and what privileges are available to the Aider process.
Exploit preconditions
- Attack surface: Project-level Aider configuration files and settings that invoke external commands
- Required access: Ability to place or modify a malicious
.aider.conf.ymlin a project the victim will use - Trigger point: Aider startup followed by a model reply or use of the
/editorcommand, depending on the configured setting - Why exploitation is possible: Configuration values are treated as executable shell commands and passed to subprocess execution with shell interpretation enabled
- Attack surface: Project-level Aider configuration files and settings that invoke external commands
- Required access: Ability to place or modify a malicious
.aider.conf.ymlin a project the victim will use - Trigger point: Aider startup followed by a model reply or use of the
/editorcommand, depending on the configured setting - Why exploitation is possible: Configuration values are treated as executable shell commands and passed to subprocess execution with shell interpretation enabled
Why this happens
The underlying bug is OS command injection caused by treating configuration-controlled strings as shell commands. Aider automatically loads attacker-influenced configuration and uses subprocess execution with shell=True, allowing shell metacharacters and command expressions in trusted-looking settings to affect process behavior. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because untrusted input reaches an operating-system command interpreter without adequate separation or validation.
The underlying bug is OS command injection caused by treating configuration-controlled strings as shell commands. Aider automatically loads attacker-influenced configuration and uses subprocess execution with shell=True, allowing shell metacharacters and command expressions in trusted-looking settings to affect process behavior. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because untrusted input reaches an operating-system command interpreter without adequate separation or validation.
Potential impact
- Arbitrary commands may execute with the victim's operating-system privileges
- Local files, credentials, source code, or environment variables could be accessed
- Project data could be modified, deleted, or exfiltrated
- Malware or persistence mechanisms could be installed
- Development workflows and software supply chains could be compromised
- Arbitrary commands may execute with the victim's operating-system privileges
- Local files, credentials, source code, or environment variables could be accessed
- Project data could be modified, deleted, or exfiltrated
- Malware or persistence mechanisms could be installed
- Development workflows and software supply chains could be compromised
General mitigation guidance
Mitigation generally focuses on treating project configuration as untrusted data rather than executable policy.
Common defensive patterns include:
- Require explicit user consent before loading project-provided command or editor settings
- Avoid shell interpretation for externally influenced values
- Invoke programs using argument arrays and restricted executable allowlists
- Separate notification and editor selection from arbitrary command strings
- Validate configuration against a strict schema and reject unexpected command-bearing fields
- Run development tools with least-privilege accounts, limited filesystem access, and constrained environment variables
- Reduce trust in repository-controlled configuration through documented project-boundary policies
Mitigation generally focuses on treating project configuration as untrusted data rather than executable policy.
Common defensive patterns include:
- Require explicit user consent before loading project-provided command or editor settings
- Avoid shell interpretation for externally influenced values
- Invoke programs using argument arrays and restricted executable allowlists
- Separate notification and editor selection from arbitrary command strings
- Validate configuration against a strict schema and reject unexpected command-bearing fields
- Run development tools with least-privilege accounts, limited filesystem access, and constrained environment variables
- Reduce trust in repository-controlled configuration through documented project-boundary policies
How teams detect issues like this
Detection can combine source analysis, configuration scanning, and runtime monitoring:
- Search code for
shell=True, shell invocation APIs, and subprocess calls that incorporate configuration values - Flag automatic loading of repository-controlled configuration without trust prompts or provenance checks
- Review notification, editor, hook, and callback settings for command execution behavior
- Scan repositories for
.aider.conf.ymlfiles containing command-bearing options or suspicious shell syntax - Enforce policies that prohibit arbitrary command strings in project configuration
- Monitor process creation by Aider and alert on unexpected child processes or access to sensitive files
- Automated code-review and static-analysis tools can help identify unsafe command construction patterns
Detection can combine source analysis, configuration scanning, and runtime monitoring:
- Search code for
shell=True, shell invocation APIs, and subprocess calls that incorporate configuration values - Flag automatic loading of repository-controlled configuration without trust prompts or provenance checks
- Review notification, editor, hook, and callback settings for command execution behavior
- Scan repositories for
.aider.conf.ymlfiles containing command-bearing options or suspicious shell syntax - Enforce policies that prohibit arbitrary command strings in project configuration
- Monitor process creation by Aider and alert on unexpected child processes or access to sensitive files
- Automated code-review and static-analysis tools can help identify unsafe command construction patterns
