Serena MCP: the IDE for your agent
A powerful toolkit for coding, providing semantic retrieval and editing capabilities.
1.5.3version the registry lists (1 published)
2reported issues
Nolisted version affected
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.oraios/serena
· Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| CVE-2026-38924In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.… | low | Not checked | Sep 14, 2026 |
| GHSA-37h2-6p4f-mp3qSerena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCEAlso filed as CVE-2026-49471, PYSEC-2026-3061 | high | Not flagged | Jul 8, 2026 |
Versions in the registry
1.5.3 (listed)