Skip to content
OpenAdvisories

Package · PyPI

serena-agent

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.3
    CVE-2026-49471

    Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

    Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protecti…

    oraios serena serena-agent PyPI