aider-chat@0.86.2

Aider is AI pair programming in your terminal

latest version

0.86.2

first published

3 years ago

latest version published

5 months ago

licenses detected

Apache-2.0
[0,)

View aider-chat package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the aider-chat package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Server-side Request Forgery (SSRF) aider-chat is an Aider is AI pair programming in your terminal Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `requests.get` function in the AWS EC2 Metadata Endpoint process. An attacker can access internal resources and potentially exfiltrate sensitive information by sending crafted requests to the affected endpoint. How to fix Server-side Request Forgery (SSRF)? A fix was pushed into the `master` branch but not yet published.	[0,)
M Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') aider-chat is an Aider is AI pair programming in your terminal Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the `editor_coder.run` function in the Architect Mode component. An attacker can execute arbitrary code by supplying crafted input to this function remotely. How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? There is no fixed version for `aider-chat`.	[0,)

Server-side Request Forgery (SSRF)

aider-chat is an Aider is AI pair programming in your terminal

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the requests.get function in the AWS EC2 Metadata Endpoint process. An attacker can access internal resources and potentially exfiltrate sensitive information by sending crafted requests to the affected endpoint.

How to fix Server-side Request Forgery (SSRF)?

A fix was pushed into the master branch but not yet published.

[0,)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

aider-chat is an Aider is AI pair programming in your terminal

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the editor_coder.run function in the Architect Mode component. An attacker can execute arbitrary code by supplying crafted input to this function remotely.

How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

There is no fixed version for aider-chat.

[0,)

Go back to all versions of this package