PT-2026-45187 · Aider · Aider

Tchen200311 · CVE-2026-10177 · Published 2026-05-31 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Aider-AI Aider version 0.86.3

Description A server-side request forgery (SSRF) issue exists in the AWS EC2 Metadata Endpoint component. This occurs within the requests.get() function located in the api docs.py file, allowing a remote attacker to manipulate requests sent by the server.

Recommendations Install the available patch for version 0.86.3. As a temporary mitigation, restrict access to the requests.get() function within the api docs.py file.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-10177

GHSA-HCHG-QM84-CJ9P

PYSEC-2026-2336

Affected Products

Aider

References · 18

• 🔥 https://github.com/Aider-AI/aider/issues/5075 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10177.json · Exploit
• https://github.com/Aider-AI/aider/pull/5137 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10177 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2336 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-10177 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hchg-qm84-cj9p · Vendor Advisory
• https://github.com/Aider-AI/aider · Note
• https://vuldb.com/cve/CVE-2026-10177 · Note
• https://pypi.org/project/aider-chat · Note
• https://github.com/advisories/GHSA-hchg-qm84-cj9p · Note
• https://t.me/cveNotify/165365 · Telegram Post
• https://twitter.com/CVEnew/status/2061216657477906880 · Twitter Post
• https://t.me/CVEtracker/55382 · Telegram Post
• https://vuldb.com/vuln/367458/cti · Note