Issue
Description:
A critical OS Command Injection vulnerability exists in the cmd_git method within aider/commands.py. The implementation uses subprocess.run with shell=True and performs string concatenation on user-supplied arguments. This allows an attacker to inject arbitrary shell commands by breaking out of the intended git command execution.
Vulnerable Code Location:
File: aider/commands.py
Method: cmd_git(self, args)
args = "git " + args # Vulnerable string concatenation
...
result = subprocess.run(
args,
# ...
shell=True, # Vulnerable execution mode
# ...
)
Attack Vector:
Because the input args is directly concatenated and passed to the system shell, an attacker can input shell metacharacters (e.g., ;, &&, |) to execute unauthorized commands.
For example, an input like status; cat ~/.ssh/id_rsa would cause the shell to execute the intended git status followed immediately by a command that exfiltrates the user's private SSH key.
Impact:
Arbitrary Code Execution: Attackers can execute any command with the privileges of the Aider process.
Sensitive Data Exfiltration: Unauthorized access to credentials, environment variables, or private source code.
System Compromise: In automated environments (e.g., CI/CD or agentic evaluation platforms), this can lead to full system takeovers or lateral movement within the infrastructure.
Proposed Remediation:
-
Disable shell=True: Never use shell=True when processing untrusted user input.
-
Use List-based Arguments: Pass command arguments as a list to subprocess.run (e.g., ["git", "status"]). This bypasses the system shell and prevents command injection entirely.
-
Input Validation: If possible, validate that the input matches an expected pattern before processing.
Version and model info
Aider version: Latest main branch (Identified via static source code analysis)
Model: N/A (Static Code Analysis)
Git repo: N/A
Repo-map: N/A
Issue
Description:
A critical OS Command Injection vulnerability exists in the cmd_git method within aider/commands.py. The implementation uses subprocess.run with shell=True and performs string concatenation on user-supplied arguments. This allows an attacker to inject arbitrary shell commands by breaking out of the intended git command execution.
Vulnerable Code Location:
File: aider/commands.py
Method: cmd_git(self, args)
args = "git " + args # Vulnerable string concatenation
...
result = subprocess.run(
args,
# ...
shell=True, # Vulnerable execution mode
# ...
)
Attack Vector:
Because the input args is directly concatenated and passed to the system shell, an attacker can input shell metacharacters (e.g., ;, &&, |) to execute unauthorized commands.
For example, an input like status; cat ~/.ssh/id_rsa would cause the shell to execute the intended git status followed immediately by a command that exfiltrates the user's private SSH key.
Impact:
Arbitrary Code Execution: Attackers can execute any command with the privileges of the Aider process.
Sensitive Data Exfiltration: Unauthorized access to credentials, environment variables, or private source code.
System Compromise: In automated environments (e.g., CI/CD or agentic evaluation platforms), this can lead to full system takeovers or lateral movement within the infrastructure.
Proposed Remediation:
Disable shell=True: Never use shell=True when processing untrusted user input.
Use List-based Arguments: Pass command arguments as a list to subprocess.run (e.g., ["git", "status"]). This bypasses the system shell and prevents command injection entirely.
Input Validation: If possible, validate that the input matches an expected pattern before processing.
Version and model info
Aider version: Latest
mainbranch (Identified via static source code analysis)Model: N/A (Static Code Analysis)
Git repo: N/A
Repo-map: N/A