CVE-2026-49471
2 advisories.
PyPI/serena-agent CVE-2026-49471: high 8.3
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
Action: Upgrade serena-agent to 1.5.2 or later.
pip install serena-agent==1.5.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.2 | - |
Fixed versions
| 1.5.2 |
Sources
- osv: GHSA-37h2-6p4f-mp3q
- https://github.com/oraios/serena/security/advisories/GHSA-37h2-6p4f-mp3q
- https://nvd.nist.gov/vuln/detail/CVE-2026-49471
- https://github.com/oraios/serena/commit/016ccbe1c095a3eed7967737ac1d4df2754f5d96
- https://github.com/oraios/serena
- https://github.com/oraios/serena/releases/tag/v1.5.2
CVE-2026-49471 · published · modified · JSON
PyPI/serena-agent CVE-2026-49471: high 8.3
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
Action: Upgrade serena-agent to 1.5.2 or later.
pip install serena-agent==1.5.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.2 | - |
Fixed versions
| 1.5.2 |
Sources
- osv: PYSEC-2026-3061
- https://github.com/oraios/serena/security/advisories/GHSA-37h2-6p4f-mp3q
- https://nvd.nist.gov/vuln/detail/CVE-2026-49471
- https://github.com/oraios/serena/commit/016ccbe1c095a3eed7967737ac1d4df2754f5d96
- https://github.com/oraios/serena
- https://github.com/oraios/serena/releases/tag/v1.5.2
- https://pypi.org/project/serena-agent
- https://github.com/advisories/GHSA-37h2-6p4f-mp3q
CVE-2026-49471 · published · modified · JSON