CVE-2026-109965

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109965
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109965.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109965
Published
2026-10-13T14:00:17Z
Modified
2026-10-15T02:47:31Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
Details

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109965.json"
}
References

Affected packages

Git / github.com/oraios/serena

Affected ranges

Type
GIT
Repo
https://github.com/oraios/serena
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4c4268f9c0adf8743a75e6dda2ef1fa635f34cc3
Fixed
6f20f9b822d85bb063008e786f808d04619dd54e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.0.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other
2025-04-01
2025-05-19
2025-05-21
2025-06-20
mit-final
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109965.json"