CVE-2026-109965
highSerena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks in…
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/oraios/serena disclosure@vulncheck.com
- https://github.com/oraios/serena/blob/v1.7.0/src/serena/project.py disclosure@vulncheck.com
- https://github.com/oraios/serena/commit/6f20f9b822d85bb063008e786f808d04619dd54e disclosure@vulncheck.com
- https://github.com/oraios/serena/issues/2144 disclosure@vulncheck.com
- https://github.com/oraios/serena/releases/tag/v2.0.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/serena-before-2.0.0-symlink-following-in-file-tools-a... disclosure@vulncheck.com
- https://github.com/oraios/serena/issues/2144 134c704f-9b21-4f2e-91b3-4a467353bcc0