serena vulnerabilities

2 known vulnerabilities in serena from Oraios. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  serena: Improper Link Resolution Before File Access

  CVE-2026-109965Oct 13, 2026Oraios

  Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks

• 8.3 High severity

  serena: Missing Authentication for Critical Functionality

  CVE-2026-49471Jul 7, 2026Oraios

  Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protectio