Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab’s Threat Research Group found a critical server-side template injection ( GHSA-pp25-4cg4-qcr9 , CVE pending) that executes arbitrary code in the Serena process. Anyone on serena-agent 1.6.1 or earlier should update to 1.7.0 now.
Discovery
Learnings
- auto_storiesStories
- categoryAreas
- helpFAQ
- forumConversations
- descriptionPapers
- mailNewsletters
- video_libraryVideos
- timelineTimeline
Guidance
- codeTechnology of APIs
- business_centerBusiness of APIs
- campaignEvangelism of APIs
- gavelGovernance of APIs
- historyHistory of APIs
- account_balancePolitics of APIs
Toolbox
- domainProviders
- apiAPIs
- cloudSolutions
- buildTools
- verifiedStandards
- gavelRegulations
- horizontal_ruleHeaders
- layersOverlays
- extensionExtensions
- schemaSchema
- policyPolicies
- ruleRules