CVE-2026-10177: Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

May 31, 2026 (updated July 7, 2026)

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The pull request to fix this issue awaits acceptance.

References

github.com/Aider-AI/aider
github.com/Aider-AI/aider/issues/5075
github.com/Aider-AI/aider/pull/5137
github.com/advisories/GHSA-hchg-qm84-cj9p
nvd.nist.gov/vuln/detail/CVE-2026-10177
vuldb.com/cve/CVE-2026-10177
vuldb.com/submit/819911
vuldb.com/vuln/367458
vuldb.com/vuln/367458/cti

Code Behaviors & Features

Detect and mitigate CVE-2026-10177 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →