CVE-2026-49471 affects oraios serena prior to version 1.5.2. The vulnerability arises from an unauthenticated Flask API exposed on a fixed, predictable port without authentication, CSRF protection, or Host header validation. An attacker can exploit this via a DNS rebinding attack from a malicious webpage to write arbitrary data to the agent's persistent memory store. Since the agent autonomously reads and acts on this data, and the execute_shell_command function is used with shell=True, this chain enables remote code execution requiring only that the victim visits a malicious webpage while Serena is running. The vulnerability is addressed in version 1.5.2.

Successful exploitation allows remote code execution on the system running Serena without prior authentication, leading to full compromise of confidentiality, integrity, and availability of the affected system. The attack requires user interaction (visiting a malicious webpage) but no other privileges. This can result in arbitrary code execution with the permissions of the Serena agent.

Upgrade Serena to version 1.5.2 or later, where this vulnerability is fixed. There is no official patch or temporary fix other than upgrading. Until upgraded, avoid visiting untrusted webpages while Serena is running to reduce risk of DNS rebinding attacks.