Approved changes feed: RSS · Atom
cpe:2.3:a:oraios:serena:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Oraios (79379f36-bfb4-5816-9030-07f20c45bd3f) |
|---|---|
| Product | Serena (1c6bcd7a-d9cd-5699-a92a-eec6ddc03995) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-109965 |
vulnerable | 2026-11-03 10:17:40.169853 |
Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
HIGH (7.1)
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
Published: 2026-10-13T14:00:17.324Z
Updated: 2026-10-13T15:29:52.632Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49471 |
vulnerable | 2026-07-29 00:57:45.465289 |
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
HIGH (8.3)
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.
Published: 2026-07-07T20:50:50.545Z
Updated: 2026-07-09T13:55:44.505Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.