Approved changes feed: RSS · Atom
cpe:2.3:a:oraios-ai:serena:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Oraios Ai (a01ed962-ec72-51c1-9908-303b35e6f4e1) |
|---|---|
| Product | Serena (36a052d3-d0fd-595e-862a-8547567df987) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-109965 |
vulnerable | 2026-11-03 10:17:40.172000 |
Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
HIGH (7.1)
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
Published: 2026-10-13T14:00:17.324Z
Updated: 2026-10-13T15:29:52.632Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.