Serena AI coding agent vulnerability allows arbitrary code execution

Serena, a widely-used AI coding agent for developers, contained a critical server-side template injection vulnerability (GHSA-pp25-4cg4-qcr9) that allowed arbitrary code execution when processing project configuration files. GitLab's Threat Research Group discovered that Serena versions 1.6.1 and earlier would execute attacker-controlled code the moment a developer opened a malicious project repository containing a specially crafted .serena/project.yml file. The flaw bypasses Serena's trust controls (trusted_project_path_patterns) by exploiting an unsandboxed Jinja2 template engine in the MCP server process. Maintainers released patched version 1.7.0 on August 9, 2026 after being notified on August 1. The vulnerability demonstrates how MCP servers - which give AI coding assistants broad access to developer environments - create new attack surfaces that go beyond traditional IDE tools.