A command injection vulnerability has been discovered in disler aider-mcp-server up to commit b2516fa. The flaw affects an unknown functionality in the server.py file of the aider_ai_code component. The vulnerability can be exploited remotely through manipulation of the relative_editable_files argument. An exploit has been published and is available for use. The project maintainers were notified early but have not responded yet. The product uses rolling releases making version tracking difficult.