EUVD-2026-42077
GHSA-37h2-6p4f-mp3q
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 07, 2026
Remote code execution in the Oraios Serena MCP coding toolkit (prior to v1.5.2) lets a malicious webpage hijack a developer's local coding agent via DNS rebinding. Serena's built-in web dashboard runs an unauthenticated Flask API on a fixed, predictable port with no auth, no CSRF protection, and no Host-header validation, so any site the victim visits while Serena is running can write attacker-controlled content into the agent's persistent memory store; because the agent autonomously reads that memory and can invoke execute_shell_command with shell=True, this chains to code execution on the developer's machine. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Serena gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.
Articles & Coverage 1
Executive ViewAI
Oraios Serena MCP coding toolkit versions prior to v1.5.2 contain a remote code execution vulnerability triggered when developers visit any website while using the tool, placing development teams at immediate risk of source code theft and development infrastructure compromise. No vendor patch is currently available, requiring urgent containment measures within 24 hours to prevent environment breach.
Within 24 hours: Disable Oraios Serena's web dashboard or isolate affected development machines from untrusted networks; contact Oraios for patch availability and timeline. Within 7 days: Audit systems running vulnerable Serena versions for unauthorized access or credential compromise; implement DNS rebinding defenses and Host-header validation at network perimeter. Within 30 days: Deploy v1.5.2 immediately upon vendor release; if unavailable after 30 days, transition development teams to alternative tools or implement permanent network isolation for Serena systems.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Serena web dashboard when not active; segment development machines from untrusted networks via firewall policy; implement DNS rebinding protections at network boundary; enforce Host-header validation on proxies; restrict Serena to offline-only or air-gapped operation; implement continuous monitoring of development machines for suspicious process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Improper link resolution in Serena before 2.0.0 allows a symlink committed inside a repository to redirect the tool's fi
Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remo
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow r
Serena, an AI coding assistant built on the Model Context Protocol (MCP), exposed its HTTP-mode server on all network in
Exploit-DB