Root cause
Other / insufficient public mechanism detail introduced
The command-line option changes commit-hook verification from enabled to disabled by default.
Aider disabled Git commit-hook verification by default. No merged repair was identified in the inspected source; restoring verification as the default is a proposed remedy.
How AI contributed: Direct introductionPublished May 31, 2026 in 
aider-ai/aider
Provisional finding. Full causal and release verification remains incomplete.
Fix status
No public fix identified
No minimum fix commit has been established for this finding.
Fix status unresolved
Case facts
- CVE ID
- CVE-2026-10174
- GHSA ID
- GHSA-C3WR-3C4V-6RMH
- Published
- May 31, 2026
- Severity
- low
- Language
- Python
- AI tool
AI-assisted; tool not identified- AI role
- Direct introduction
- Vulnerable release
- 0.86.2 and 0.86.3.dev (inspected source)
AI-assisted change
AI-assisted changeaider/args.pysource aider-ai/aider@fe795cc2d5+2−2
@@ -438,11 +438,11 @@ ) group.add_argument( "--git-commit-verify", action=argparse.BooleanOptionalAction,- default=True,- help="Enable/disable git pre-commit hooks with --no-verify (default: True)",+ default=False,+ help="Enable/disable git pre-commit hooks with --no-verify (default: False)", ) group.add_argument(Show 3 hidden lines
"--commit", action="store_true", help="Commit all pending changes with a suitable commit message, then exit",The command-line option changes commit-hook verification from enabled to disabled by default.
Advisory references
- https://nvd.nist.gov/vuln/detail/CVE-2026-10174
- https://github.com/Aider-AI/aider/issues/5057
- https://github.com/Aider-AI/aider
- https://vuldb.com/cve/CVE-2026-10174
- https://vuldb.com/submit/819901
- https://vuldb.com/vuln/367455
- https://vuldb.com/vuln/367455/cti
- https://github.com/advisories/GHSA-c3wr-3c4v-6rmh