Critical RCE in Serena MCP agent: opening a repo runs attacker code
GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9) in Serena, one of the most-used MCP coding agents: a malicious .serena/project.yml runs attacker code the instant a developer opens a repo, bypassing the trusted-project gate. Affects serena-agent 1.6.1 and earlier; update to 1.7.0. It's an early warning for a new class of MCP-server supply-chain risk.