GitLab Finds Critical Template-Injection Flaw in Serena, an MCP Coding Agent, Bypassing Its Untrusted-Project Safeguard
A critical Jinja2 template-injection bug let attacker-controlled repository files execute code in the Serena coding agent, bypassing its own trust gate.
Overview
A critical vulnerability in Serena, an open-source coding agent built on the Model Context Protocol (MCP), allowed a malicious code repository to execute arbitrary commands on a developer’s machine the moment it was opened, according to a GitHub Security Advisory published by the project’s maintainers. The flaw bypassed the very safeguard Serena built to stop untrusted repositories from running code, and it required no authentication, no network access, and no tool call by the user.
The issue is tracked as GHSA-pp25-4cg4-qcr9 and rated critical. No CVE identifier has been assigned to it yet. It affects serena-agent versions 1.6.1 and earlier and is fixed in version 1.7.0, released August 9, 2026.
What We Know
Serena describes itself as “a powerful MCP toolkit for coding, providing semantic retrieval and editing capabilities - the IDE for your agent,” according to its own GitHub repository. It connects AI assistants to a developer’s local codebase over MCP, giving them semantic code navigation, refactoring, and editing tools rather than raw file access. Per the project’s README, it integrates with terminal-based clients including Claude Code, Codex, OpenCode, and Gemini-CLI, with IDE plugins for VS Code, Cursor, and JetBrains IDEs, and with desktop and web clients such as Claude Desktop, Codex App, and OpenWebUI. The repository has drawn more than 28,000 GitHub stars and nearly 1,900 forks, according to the project’s own GitHub page.
According to the advisory, “Serena renders per-project mode/context prompt fields as Jinja2 templates using a non-sandboxed jinja2.Environment().” A project can define custom “modes” — named configurations whose prompt text gets injected into the AI model’s system prompt. A malicious repository can reference an attacker-authored mode file through a path-like added_modes entry in its .serena/project.yml configuration file. When Serena activates the project, that mode’s prompt string is compiled and rendered as a template — and because the rendering environment isn’t sandboxed, the advisory states that “the prompt string can carry a standard Jinja SSTI gadget and achieve arbitrary code execution in the Serena process, on stock defaults…, with no network, no authentication, and no tool call.”
The advisory emphasizes that this path bypassed Serena’s own defense against exactly this scenario. Serena includes a trusted_project_path_patterns setting and an is_trusted() check that are supposed to stop untrusted repositories from running code — but, per the advisory, “this path is not covered by trusted_project_path_patterns / is_trusted() — the control Serena built specifically to stop untrusted projects from executing code (it gates activation_command and ls_specific_settings).” The maintainers say they “empirically confirmed that on an untrusted project (trusted_project_path_patterns = []), activation_command is correctly blocked while this SSTI still executes,” concluding it amounted to “a bypass of Serena’s own untrusted-project protection.”
The advisory credits two reporters, listed on GitHub as amagesh1 and Den1al. According to Den1al’s GitHub profile, the account belongs to a “Vulnerability Research Group Manager” at GitLab, and GitLab has published its own account of the research attributing the discovery to its Threat Research Group. Serena’s maintainers state in the advisory that the flaw affects serena-agent versions 1.6.1 and earlier and is resolved in version 1.7.0.
What We Don’t Know
No CVE number has been assigned to the flaw as of publication, and Serena’s maintainers have not disclosed a CVSS score in the public advisory. The exact timeline between when the vulnerability was first reported to the maintainers and when the fix shipped has not been independently confirmed beyond the August 9 patch release date. It’s also not publicly known how many Serena deployments were running a vulnerable version at the time of disclosure, since the project does not publish live installation or download figures.
Analysis
The flaw illustrates a security gap distinctive to coding agents built on MCP: unlike traditional developer tools such as linters or CI test runners that touch a codebase narrowly, MCP-connected agents like Serena are designed to give an AI model broad access to a developer’s local environment, often running with the same file-system and shell privileges as the developer themselves. A trust control that closes one avenue for attacker-controlled repository content to reach code execution — here, activation_command — can still leave others open, as the advisory found with the separate, unguarded path through mode-file template rendering. Developers who routinely open unfamiliar repositories with agent tooling, whether to evaluate an open-source library or triage a bug report, are the population most exposed to this class of bug.