Product
A command injection vulnerability (CVE-2026-7157) exists in disler aider-mcp-server, allowing remote attackers to execute arbitrary commands by manipulating the relative_editable_files argument in the aider_ai_code component's server.py.