CVE-2026-109965
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Oct 13, 2026
Vendor
unknown
Description
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.