Improper Link Resolution Vulnerability in Serena by OraiOS

CVE-2026-109965

What is CVE-2026-109965?

Serena, prior to version 2.0.0, has a vulnerability that arises from improper link resolution. This flaw enables attackers to manipulate symlinks within a repository, potentially gaining access to sensitive files located outside the intended project root. Since the function Project.is_path_in_project() does not effectively resolve symlinks, it allows file manipulation tools—such as read_file and create_text_file—to read or overwrite critical files, including SSH keys and cloud credentials. This can lead to significant security risks if exploited.

References