# Critical Security Vulnerability in Serena AI Coding Tool

Remote code execution flaw discovered in popular MCP coding assistant.

- **Source:** [GitLab](https://brifing.si/source/76101668-80db-4240-8676-e968d2b72546)
- **Published:** 2026-08-17
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://about.gitlab.com/blog/critical-rce-in-serena/>
- **On Brifing:** https://brifing.si/s/6686d3e6-e55d-48d3-86e7-10993e089809

## Discovery of Critical Vulnerability

GitLab's Threat Research Team discovered a critical server-side template injection (GHSA-pp25-4cg4-qcr9) in the popular AI coding assistant Serena. This vulnerability allows execution of attacker-supplied code when a developer opens a project. Users of Serena 1.6.1 and earlier versions must immediately update to 1.7.0.

## Attack Vector

Attackers can exploit this flaw by placing a malicious .serena/project.yml file in a repository they control. When a developer opens this file via the Serena Model Context Protocol (MCP) server, it bypasses the trusted_project_path_patterns control specifically designed to prevent untrusted repositories from executing code.

## Significance of the Vulnerability

This flaw represents an early example of a risk class that may become widespread as MCP servers become more embedded in the software development lifecycle. MCP servers create a different attack surface by providing broad access to developers' local environments compared to traditional developer tools.

## Risks of MCP Servers

While traditional developer tools have limited access to codebases (linters read, formatters write), MCP servers provide large language models (LLMs) with extensive privileges including filesystem access, shell command execution, and network operations. This broad access makes server process compromise significantly more dangerous.

## Developer Environment Threat

Unlike CI/CD pipelines that run in isolated environments, MCP servers operate on the developer's own machine with user context privileges. This gives attackers potential access to SSH keys, cloud provider credentials, .env files, and internal network resources. Compromising the server process means compromising the entire local developer environment.

## Serena's Security Model

Serena includes a trust model designed to prevent untrusted repositories from executing code. However, a gap was found in this model. While the trusted_project_path_patterns mechanism controls features like activation_command, it doesn't validate the template injection path.

## Technical Details of the Vulnerability

Serena uses Jinja2 template engine for defining custom modes in projects, but runs it without sandboxing. The plain jinja2.Environment() usage in src/interprompt/jinja_template.py allows attackers to access Python's os and subprocess modules. Jinja2's SandboxedEnvironment exists for this purpose but wasn't used here.

## Attack Mechanism

The added_modes field in a project's .serena/project.yml file lists additional modes to activate. Serena loads path-like entries directly from the filesystem. While the YAML parser is safe, the prompt field content is later passed to the unsandboxed template engine, enabling code injection.

## Security Control Bypass

Serena's is_trusted() mechanism controls activation_command and ls_specific_settings features but doesn't validate the mode loading and template rendering path. The added_modes list from an untrusted project is processed without validation, bypassing security controls when the prompt reaches the template engine.

## Industry Implications

This vulnerability demonstrates that security models for AI-assisted development tools are not yet mature. As protocols like MCP become more widespread, new approaches will be needed to secure developer environments. Companies using such tools must implement additional security measures and apply updates promptly.

## Sources covering this story

- https://about.gitlab.com/blog/critical-rce-in-serena/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._