Medium severity · published May 31, 2026
CVE-2026-10176
Aider-AI Aider Code Generation Workflow sql injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aider · Aider-AI
0.86.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10176
github.com
https://github.com/Aider-AI/aider/
github.com
https://github.com/Aider-AI/aider/issues/5077
vuldb.com
https://vuldb.com/cve/CVE-2026-10176
vuldb.com
https://vuldb.com/submit/819910
vuldb.com
https://vuldb.com/vuln/367457
vuldb.com
https://vuldb.com/vuln/367457/cti
More from Aider
7.8
CVE-2026-115726
Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings
7.8
CVE-2026-85674
aider 0.86.2 Remote Code Execution via .aider.conf.yml
6.3
CVE-2026-10177
Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery
6.3
CVE-2026-10175
Aider-AI Aider Architect Mode auth.py editor_coder.run code injection
6.3
CVE-2026-10174
Aider-AI Aider Pre-commit Hook args.py protection mechanism