Executive brief
Serena, an AI agent tool, contains a security flaw in its web dashboard that allows an attacker to take control of a user's computer. By tricking a user into visiting a malicious website, an attacker can bypass security checks to inject commands into the agent's memory. This can lead to the theft of sensitive logs, unauthorized configuration changes, or the execution of malicious software on the victim's system.
Technical details
The Serena agent's Flask-based dashboard (default port 24282) lacks authentication, CSRF protection, and Host header validation. This allows an attacker to perform a DNS rebinding attack via a malicious webpage, bypassing Same-Origin Policy (SOP) to interact with the local API. An attacker can use the `/save_memory` endpoint to inject malicious instructions into the agent's persistent memory. Because the agent's `execute_shell_command` utility uses `subprocess.Popen` with `shell=True` by default, these injected instructions can result in arbitrary OS command execution when the agent next processes its memory. The vulnerability is patched in version 1.5.2.
Affected products
- oraios serena-agent < 1.5.2
Timeline
- 2026-07-01: disclosed: Initial disclosure to vendor
- 2026-07-01: patched: Version 1.5.2 released
- 2026-07-07: advisory: NVD publication date
- 2026-07-08: advisory: GitHub Advisory published