Critical remote code execution in Serena, a popular MCP coding agent

This post details a critical server-side template injection vulnerability (CVE pending) in Serena, an AI coding agent, that allows arbitrary code execution on a developer's machine. The vulnerability arises from the use of an unsandboxed Jinja2 template engine and the processing of project configuration files (`.serena/project.yml`) without adequate trust checks. The exploit bypasses Serena's `trusted_project_path_patterns` control. The post provides a detailed call chain, explains the exposure, and offers recommendations for users to update to `serena-agent 1.7.0` and for developers of AI coding tools to implement robust validation, sandboxing, and comprehensive trust gates. It highlights MCP servers as a new attack surface with significant implications for developer security.