GHSA-37h2-6p4f-mp3q: Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

Summary

Serena's built-in web dashboard exposes an unauthenticated Flask API on fixed TCP port 24282 (hardcoded as 0x5EDA in constants.py), with no authentication, no CSRF protection and no Host header validation. A DNS rebinding attack lets a malicious webpage write arbitrary content to the agent's persistent memory, which the agent later reads and acts on, reaching execute_shell_command, enabled by default through shell=True, for remote code execution. The source states that any user running Serena with the default configuration is affected, and the chain requires only that the victim visit a malicious webpage while Serena is running.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-108759: mistral.rs sandbox escape via symlinks in mistralrs-code-execSimilar attack · NVD/CVE Database
• MediumCVE-2026-108756: Abilityai Trinity missing authorization in Telegram router binding operationsSimilar attack · NVD/CVE Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySimilar attack · NVD/CVE Database
• MediumCVE-2026-108574: BerriAI LiteLLM authorization bypass in session spend log view via session_idSimilar attack · NVD/CVE Database
• MediumCVE-2026-108670: JeecgBoot missing authorization in AiragPromptsControllerSimilar attack · NVD/CVE Database