Security : an edit format can write and delete files outside the repository root, bypassing the edit-confirmation prompt

I'd like to report a security vulnerability in aider privately (currently unpatched). This repo has no SECURITY.md and GitHub private vulnerability reporting is not enabled, so there is no private channel to send details to.

Please either enable Settings → Advanced Security → Private vulnerability reporting, or share a security contact (email). I'll then send the full write-up, a one-command reproduction, CVSS, and a proposed patch.

High level only (no specifics here): in one of aider's edit formats, a file operation can be steered to a destination outside the repository root. That destination is neither confined to the repo nor surfaced by the edit-confirmation prompt users rely on, so aider can create/overwrite a file anywhere the process can write — and delete the in-repo original — with no prompt. Because the written content and path are model-controlled and aider routinely feeds untrusted text to the model, this allows writing to sensitive locations and, in turn, code execution. Assessed High severity (path traversal + confirmation bypass).

Reproduced against current main. Happy to follow a 90-day coordinated-disclosure timeline. Filing a separate issue for another, unrelated finding.

Thanks!