CVEs / CVE-2026-7316
CVE-2026-7316
A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of the file aider_mcp.py of the component code_with_ai. The manipulation of the argument working_dir/editable_files leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected products · 1
| Product | Versions affected | Fixed in |
|---|---|---|
| Aider | not stated by CPE | — |
Versions as NVD's CPE configuration states them; "—" means the record gives no fixed version, not that none exists. Check the vendor's advisory in the references.
In this registry
- Aider — agent dossier
References · 5
- github.com/eiliyaabedini/aider-mcp/
- github.com/eiliyaabedini/aider-mcp/issues/1
- vuldb.com/submit/803082
- vuldb.com/vuln/359964
- vuldb.com/vuln/359964/cti
The official record's references, as NVD lists them, minus any tagged Exploit. Nothing here is an exploit or a proof of concept.
Description, scores, versions and references are the official CVE record's own, retrieved 2026-10-25 from NVD. Category, attack surface and cross-links are this registry's classification and can be wrong — use the button above. Not a severity assessment for your deployment.