CVE-2026-109965

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.ispathinproject normalizes paths lexically without resolving symlinks, so file tools like readfile and...

CVE-2026-109965

Serena versions before 2.0.0 are vulnerable to an improper link resolution vulnerability (CWE-59). The root cause is that Project.is_path_in_project() normalizes paths lexically without resolving symlinks. This allows an attacker to commit symlinks inside a repository to access, read, or overwrit...

CVE-2026-109965 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.ispathinproject normalizes paths lexically without resolving symlinks, so file tools like readfile and...

CVE-2026-109965

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.ispathinproject normalizes paths lexically without resolving symlinks, so file tools like readfile and...

Oraios AI Serena post-link vulnerability

Oraios AI Serena versions prior to 2.0.0 had a post-link vulnerability. This vulnerability stemmed from improper link parsing. The Project.ispathinproject function only normalized lexical paths but did not parse symbolic links properly. Attackers could exploit this vulnerability by submitting...