GHSA-37h2-6p4f-mp3q: Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

Serena, an AI agent framework, runs an unauthenticated Flask web dashboard on a fixed port (24282) with no login protection or security checks. An attacker can use DNS rebinding (a technique where an attacker controls a domain and redirects it to a victim's local machine) to write malicious commands into Serena's memory from a malicious webpage, which the agent then executes using `shell=True` (a mode that allows shell code injection). This creates a complete remote code execution vulnerability that requires only visiting a malicious website while Serena is running.