Critical Security Vulnerability in Serena AI Coding Tool
Remote code execution flaw discovered in popular MCP coding assistant.
1Discovery of Critical Vulnerability
GitLab's Threat Research Team discovered a critical server-side template injection (GHSA-pp25-4cg4-qcr9) in the popular AI coding assistant Serena. This vulnerability allows execution of attacker-supplied code when a developer opens a project. Users of Serena 1.6.1 and earlier versions must immediately update to 1.7.0.
2Attack Vector
Attackers can exploit this flaw by placing a malicious .serena/project.yml file in a repository they control. When a developer opens this file via the Serena Model Context Protocol (MCP) server, it bypasses the trusted_project_path_patterns control specifically designed to prevent untrusted repositories from executing code.
3Significance of the Vulnerability
This flaw represents an early example of a risk class that may become widespread as MCP servers become more embedded in the software development lifecycle. MCP servers create a different attack surface by providing broad access to developers' local environments compared to traditional developer tools.
4Risks of MCP Servers
While traditional developer tools have limited access to codebases (linters read, formatters write), MCP servers provide large language models (LLMs) with extensive privileges including filesystem access, shell command execution, and network operations. This broad access makes server process compromise significantly more dangerous.
5Developer Environment Threat
Unlike CI/CD pipelines that run in isolated environments, MCP servers operate on the developer's own machine with user context privileges. This gives attackers potential access to SSH keys, cloud provider credentials, .env files, and internal network resources. Compromising the server process means compromising the entire local developer environment.
6Serena's Security Model
Serena includes a trust model designed to prevent untrusted repositories from executing code. However, a gap was found in this model. While the trusted_project_path_patterns mechanism controls features like activation_command, it doesn't validate the template injection path.
7Technical Details of the Vulnerability
Serena uses Jinja2 template engine for defining custom modes in projects, but runs it without sandboxing. The plain jinja2.Environment() usage in src/interprompt/jinja_template.py allows attackers to access Python's os and subprocess modules. Jinja2's SandboxedEnvironment exists for this purpose but wasn't used here.
8Attack Mechanism
The added_modes field in a project's .serena/project.yml file lists additional modes to activate. Serena loads path-like entries directly from the filesystem. While the YAML parser is safe, the prompt field content is later passed to the unsandboxed template engine, enabling code injection.
9Security Control Bypass
Serena's is_trusted() mechanism controls activation_command and ls_specific_settings features but doesn't validate the mode loading and template rendering path. The added_modes list from an untrusted project is processed without validation, bypassing security controls when the prompt reaches the template engine.
10Industry Implications
This vulnerability demonstrates that security models for AI-assisted development tools are not yet mature. As protocols like MCP become more widespread, new approaches will be needed to secure developer environments. Companies using such tools must implement additional security measures and apply updates promptly.
Original article: GitLab — Serena AI Kod Aracında Kritik Güvenlik Açığı