GitHub Advisoryadvisory · PyPI

GHSA-hchg-qm84-cj9p Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

LOW Published 2026-05-31 Modified 2026-07-07 Official page ↗
Aliases
CVE-2026-10177
Ecosystem
PyPI
Packages
aider-chat
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-918
Reviewed
2026-07-07

Affected packages

• PyPI aider-chat: <= 0.86.2 (no fix yet)

Description

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The pull request to fix this issue awaits acceptance.

Related

Alias · CVE (1)

  • CVE-2026-10177 A security vulnerability has been detected in Aider-AI Aider 0.86.3. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References