Serena
Monthly
Remote code execution in the Oraios Serena MCP coding toolkit (prior to v1.5.2) lets a malicious webpage hijack a developer's local coding agent via DNS rebinding. Serena's built-in web dashboard runs an unauthenticated Flask API on a fixed, predictable port with no auth, no CSRF protection, and no Host-header validation, so any site the victim visits while Serena is running can write attacker-controlled content into the agent's persistent memory store; because the agent autonomously reads that memory and can invoke execute_shell_command with shell=True, this chains to code execution on the developer's machine. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Serena, an AI coding assistant built on the Model Context Protocol (MCP), exposed its HTTP-mode server on all network interfaces (0.0.0.0) by default in versions before 1.0.0, allowing any host reachable on the same network to connect to the unauthenticated MCP endpoint. The MCP protocol is a tool-execution channel for LLM agents; in a coding assistant context, those tools routinely include file system access and potentially shell invocation, making the true blast radius of unrestricted access substantially higher than the NVD CVSS of 2.9 suggests. A security blog (dash.security) characterizes the issue as unauthenticated remote code execution, a claim the official scoring does not reflect; no active exploitation is confirmed and no KEV listing exists.
Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Remote code execution in the Oraios Serena MCP coding toolkit (prior to v1.5.2) lets a malicious webpage hijack a developer's local coding agent via DNS rebinding. Serena's built-in web dashboard runs an unauthenticated Flask API on a fixed, predictable port with no auth, no CSRF protection, and no Host-header validation, so any site the victim visits while Serena is running can write attacker-controlled content into the agent's persistent memory store; because the agent autonomously reads that memory and can invoke execute_shell_command with shell=True, this chains to code execution on the developer's machine. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Serena, an AI coding assistant built on the Model Context Protocol (MCP), exposed its HTTP-mode server on all network interfaces (0.0.0.0) by default in versions before 1.0.0, allowing any host reachable on the same network to connect to the unauthenticated MCP endpoint. The MCP protocol is a tool-execution channel for LLM agents; in a coding assistant context, those tools routinely include file system access and potentially shell invocation, making the true blast radius of unrestricted access substantially higher than the NVD CVSS of 2.9 suggests. A security blog (dash.security) characterizes the issue as unauthenticated remote code execution, a claim the official scoring does not reflect; no active exploitation is confirmed and no KEV listing exists.
Cross-site request forgery (CSRF) vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.