An unauthenticated remote code execution vulnerability in the aider-mcp-server tool allows attackers to compromise the underlying host system.

The application improperly neutralizes shell metacharacters within the relative_editable_files parameter of the aider_ai_code tool, which is subsequently passed to a shell execution sink. This allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands.

The vulnerability poses a severe risk to organizational infrastructure, as it grants full command execution on the host running the server. Successful exploitation could lead to total system compromise, including the exfiltration of sensitive repository secrets, SSH keys, or the modification of critical source code, resulting in significant data loss or operational disruption. The CVSS score of 7.3 reflects a high severity, indicating a significant threat to confidentiality, integrity, and availability.

Immediate Action: There is currently no official patch available; users should immediately cease public exposure of the aider-mcp-server or restrict access to trusted, authenticated users only.

Proactive Monitoring: Monitor server logs for suspicious command-line patterns, such as the inclusion of shell metacharacters like semicolons, backticks, or dollar signs within tool input parameters.

Compensating Controls: Deploy the service behind a reverse proxy or Web Application Firewall that enforces strict input validation on JSON-RPC requests, specifically blocking payloads containing shell-sensitive characters in the relative_editable_files field.

Public Exploit Available: Yes, a functional proof-of-concept has been published in the official project issue tracker (GitHub issue 16).

Given the availability of a public proof-of-concept and the critical nature of command injection, this vulnerability must be treated with high urgency. Organizations currently running aider-mcp-server should isolate the instance from untrusted networks immediately. Until a vendor-supplied patch is released, ensure the service runs under a least-privileged service account to limit the potential impact of a successful exploit.