oraios Serena: Symlink following allows access outside project root
Summary
Serena, an MCP toolkit that gives AI coding agents file and code tools, does not resolve symbolic links when checking whether a file lies inside the project. A malicious repository containing symlinks can make the file tools read or overwrite files outside the project, such as SSH keys or cloud credentials. The attack requires a user to open the malicious repository with Serena, and the CVSS vector assumes user interaction.
Affected
- Serena versions before 2.0.0 (PyPI package serena-agent)
Fixed in
- Serena 2.0.0 (released 2026-10-13)
Workaround
- Until patched, treat cloned or third-party repositories as untrusted.
- Restrict which files the agent process can read, and keep SSH keys and cloud credentials outside its reach.
- Check how trusted_project_path_patterns is set in your deployments, as the fix depends on the project trust setting.
Exploitation
- Not known to be exploited. CISA SSVC lists exploitation as 'poc' and automatable as 'no'.
- The mechanism is publicly described in the original issue. No public exploit code was found.
- Sources disagree on exploit availability, so this is unverified.
Our recommendation
- Upgrade Serena to version 2.0.0 or later.
- Until then, do not open untrusted repositories with Serena or its AI agents.
- Review SSH keys and cloud credentials that may be reachable from affected systems and rotate them if exposure is suspected.
- Check the 2.0.x release notes for the follow-up symbol discovery issue (#2163) and its fix status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Serena project repository github.com
- Serena v2.0.0 release github.com
- Serena changelog github.com
- Fix commit 6f20f9b github.com
- Serena issue 2144 (original report) github.com
- project.py at v1.7.0 (vulnerable code) github.com
- VulnCheck advisory www.vulncheck.com
- Serena issue 2163 (follow-up regression) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:33.
Original description (NVD)
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
NVD references (7)
- https://github.com/oraios/serena
- https://github.com/oraios/serena/blob/v1.7.0/src/serena/project.py
- https://github.com/oraios/serena/commit/6f20f9b822d85bb063008e786f808d04619dd54e
- https://github.com/oraios/serena/issues/2144
- https://github.com/oraios/serena/releases/tag/v2.0.0
- https://www.vulncheck.com/advisories/serena-before-2.0.0-symlink-following-in-file-tools-allows-access-outsid…
- https://github.com/oraios/serena/issues/2144
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.