AIKIDO-2026-365704
serena-agent is vulnerable to Server-Side Template Injection (SSTI)
96
Critical Risk
This Affects:
serena-agentTL;DR
Serena renders per-project mode/context prompt fields as Jinja2 templates using a non-sandboxed jinja2.Environment(). A project can pull in an untrusted mode file via a path-like added_modes entry in its .serena/project.yml, and that mode's prompt string is compiled and rendered during system-prompt construction on project activation. Because the environment is unsandboxed, a crafted prompt carries a template-injection gadget that executes arbitrary code in the Serena process with no network, authentication, or tool call. The fix renders prompts in a sandboxed Jinja environment to block template-driven code execution.
Who does this affect?
You are affected if you run a version within the vulnerable range and activate a project that references an untrusted mode/context file whose prompt field carries template-injection content.
Background info
serena-agent is vulnerable to Server-Side Template Injection (SSTI) in versions 0.0.1 - 1.6.1.
How to fix this
Upgrade the serena-agent library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant