Serena CVE-2026-109965

Exploitation requires the victim to use Serena (before 2.0.0) to operate on an attacker-influenced repository that contains a committed symlink whose target lexically appears inside the project root but resolves outside it; the affected file tools are read_file, create_text_file, and the line-based/symbol-level editing tools (which previously skipped the path-confinement check entirely). Limiting factors: the attack is LOCAL (the attacker must get their symlink into a repo the victim opens) and needs the victim to actually work in that project (UI:P), so it does not apply to trusted first-party repositories; the v2.0.0 fix only follows out-of-root symlinks for projects explicitly marked trusted, meaning untrusted/default handling is what is exposed. No network service is exposed and no authentication on the victim system is required of the attacker.

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) correctly models this as a LOCAL vulnerability requiring passive user interaction, not a remotely-reachable flaw - the attacker does not need privileges on the target but does need the victim to open and work in an attacker-prepared repository using Serena. Impact is high for both confidentiality and availability-of-integrity (VC:H/VI:H), since file tools can both read (e.g. SSH keys, cloud credentials) and overwrite files outside the project root. There is NO CISA KEV listing and NO public exploit identified in the provided data, and no EPSS score was supplied, so there is no evidence of active or at-scale exploitation. The reporting by VulnCheck plus a vendor patch and a conceptually simple symlink-following primitive mean a working exploit is trivial to construct, but real-world risk is bounded by the LOCAL vector and the requirement that the victim use Serena against an untrusted repository. Net: a legitimate, straightforward-to-exploit flaw worth patching promptly for anyone using Serena on untrusted code, but not an internet-facing emergency - the 8.4 score is driven by impact, not by remote reachability.

An attacker publishes or contributes to a Git repository that contains a symlink pointing outside the project tree (for example a file linking to ~/.ssh/id_rsa or ~/.aws/credentials). When a victim opens that repository in Serena (before 2.0.0) and an agent invokes read_file, the lexical-only path check in is_path_in_project() is bypassed, leaking the linked secret; create_text_file can similarly overwrite files outside the project. No public exploit code is identified at time of analysis, but the technique is trivial and the vulnerable code path is documented in the patch.