Security: opening an untrusted repo can turn an approved command into host code execution via auto-loaded per-repo config

I'd like to report a security vulnerability in aider privately (currently unpatched). This repo has no SECURITY.md and GitHub private vulnerability reporting is not enabled, so there is no private channel to send details to.

Please either enable Settings → Advanced Security → Private vulnerability reporting, or share a security contact (email). I'll then send the full write-up, a one-command reproduction, CVSS, and a proposed patch.

High level only (no specifics here): aider auto-loads untrusted per-repository configuration into the process environment at startup, and commands aider later spawns inherit it. As a result, when a user opens or clones an untrusted repository and approves an innocuous, read-only-looking command, that approval can execute attacker-controlled code on the host, with the user's privileges. The command the user sees and approves is not the code that actually runs, so the existing confirmation prompt does not stop it. Assessed High severity (host code execution).

Reproduced against current main and the released aider-chat 0.86.2. Happy to follow a 90-day coordinated-disclosure timeline. Filing a second issue for a separate, unrelated finding.

Thanks!