AIKIDO-2026-365704

serena-agent is vulnerable to Server-Side Template Injection (SSTI)

Server-Side Template Injection (SSTI)GHSA-pp25-4cg4-qcr9 Published Aug 12, 2026

Critical Risk

This Affects:

serena-agent

0.0.1 - 1.6.1

Fixed in 1.7.0

Are you affected? Scan for Free

TL;DR

Serena renders per-project mode/context prompt fields as Jinja2 templates using a non-sandboxed jinja2.Environment(). A project can pull in an untrusted mode file via a path-like added_modes entry in its .serena/project.yml, and that mode's prompt string is compiled and rendered during system-prompt construction on project activation. Because the environment is unsandboxed, a crafted prompt carries a template-injection gadget that executes arbitrary code in the Serena process with no network, authentication, or tool call. The fix renders prompts in a sandboxed Jinja environment to block template-driven code execution.

Who does this affect?

You are affected if you run a version within the vulnerable range and activate a project that references an untrusted mode/context file whose prompt field carries template-injection content.