Critical remote code execution in Serena, a popular MCP coding agent

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9, CVE pending) that executes arbitrary code in the Serena process. Anyone on serena-agent 1.6.1 or earlier should update to 1.7.0 now.A threat actor can exploit this by hiding a malicious .serena/project.yml file into a repository it controls and getting a developer to open it via the Serena Model Context Protocol (MCP) server. The flaw bypasses trusted_project_path_patterns, the control Serena built specifically to stop untrusted repositories from running code. We reported it privately on August 1, 2026, and the maintainers shipped a fix eight days later.It is an early example of a risk class that will spread as MCP servers become embedded in the software development lifecycle.Why MCP servers are a different kind of attack surfaceMost developer tools touch a codebase in a narrow way: A linter reads files, a formatter writes them, and a test runner executes a specific harness. Conversely, MCP servers hand a large language model (LLM) a general-purpose interface to the developer's environment, covering file system access, shell execution, language server queries, and sometimes the network. The same reach that makes them useful makes compromising the server process severe.CI/CD pipelines run in isolated environments with scoped credentials. MCP servers run on the developer's own machine, in the developer's own user context, with access to everything the …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://about.gitlab.com/blog/critical-rce-in-serena/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.