CVE-2026-7157— disler aider-mcp-server aider_ai_code server.py command injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
disler aider-mcp-server aider_ai_code server.py command injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aider_mcp_server/server.py of the component aider_ai_code. This manipulation of the argument relative_editable_files causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Aider MCP Server 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Aider MCP Server是IndyDevDan个人开发者的一个AI编码任务卸载与协作工具。 Aider MCP Server存在注入漏洞，该漏洞源于aider_ai_code组件文件src/aider_mcp_server/server.py中未知功能对参数relative_editable_files操作不当，可能导致命令注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| disler | aider-mcp-server | b2516fa466d0d851932da92ee6d0e66946db9efc | - |
II. Public POCs for CVE-2026-7157
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7157
请登录查看更多情报信息。
- Submit #802061: disler aider-mcp-server 0.1.0 Command Injectionthird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-7157
IV. Related Vulnerabilities
V. Comments for CVE-2026-7157
No comments yet