What happened
VulnCheck published CVE-2026-115726 on October 23, 2026, rated high at 8.5 on CVSS 4.0. The open-source AI pair-programming tool Aider, through version 0.86.2, automatically loads a .aider.conf.yml file committed inside a repository without a trust prompt; an attacker can set the notifications-command or editor values in that file, and Aider then runs them through the shell after a model reply or when the /editor command is used, with the developer's privileges. As of October 25, 0.86.2 is still the newest Aider release on PyPI, so there is no patched version to upgrade to. (VulnCheck advisory: Aider through 0.86.2 command execution via .aider.conf.yml, Oct. 23, 2026)
What it means for Canada: our assessment
No Canadian victims have been reported. This is our assessment: Canadian software teams, fintechs and agencies that use Aider to work on cloned, forked or contributed code are exposed, because simply running Aider inside an untrusted repository can execute an attacker's command on a laptop that often holds cloud keys, Git tokens and model API keys.
- Sectors
- Software and SaaS companies · Fintechs and bank technology teams · Digital and marketing agencies · AI startups · Universities and research labs
- Tools involved
- Aider (aider-chat) 0.86.2 and earlier · Git repositories from outside contributors or open-source forks · Developer laptops holding cloud, GitHub and LLM API credentials
- Canadian rules
- PIPEDA: if stolen developer credentials lead to unauthorized access to personal information, a breach with a real risk of significant harm must be reported to the Privacy Commissioner and affected people notified
Quebec Law 25: confidentiality incidents involving personal information must be reported to the Commission d'accès à l'information and recorded in the incident register
OSFI B-13: federally regulated financial institutions must manage technology and cyber risk across their software development tools and practices
Bill C-8 (Critical Cyber Systems Protection Act): designated operators must cover third-party and software supply-chain risk in their cyber security programs
Assessment, not documented exposure. Aider is a widely used open-source coding assistant, and the flaw needs no special setup: any user who runs Aider in a repository containing a malicious .aider.conf.yml is exposed. Canadian development teams that use Aider face the same risk as anyone else, and no fix is available yet.
Takeaways for Canadian businesses
- BusinessInventory developer machines and CI images for aider-chat (pip show aider-chat). Every installed version is affected, because 0.86.2 is the latest release and VulnCheck lists all versions through 0.86.2.
- BusinessBefore running Aider in any cloned, forked or externally contributed repository, open .aider.conf.yml and remove or reject any notifications-command or editor entry you did not set yourself.
- BusinessAdd a code-review or CI rule that flags new or changed .aider.conf.yml files in pull requests, the same way you would review a change to a build script.
- BusinessRun Aider on untrusted code only inside a disposable container or VM that holds no production cloud keys, GitHub tokens or model API keys, and track Aider issue #5885 for a fixed release.
- BusinessIf you suspect a developer machine ran a malicious config, rotate every credential it could read and report the incident to the Canadian Centre for Cyber Security at cyber.gc.ca.
For the Canadian AI sector
It is another case of an AI coding tool treating files inside a project as trusted instructions, after this week's AGENTS.md and CLAUDE.md hijacks. Canadian AI teams should treat per-repository agent config files as code that needs review, not as harmless settings.
Written by AgentsNorth from the source below. General information, not legal or security advice.