Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.

Affected: PyPI: serena-agent

### Summary

Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282, hardcoded as `0x5EDA` in `constants.py`). The server has no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store — which the agent reads and acts on autonomously. Combined with `execute_shell_command` (enabled by default in all contexts via `shell=True`), this creates a full remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running.

### Details

**Root cause 1 — Unauthenticated dashboard (`src/serena/dashboard.py`)**

The Flask server starts automatically (`web_dashboard: true` by default) on a fixed, predictable port with no auth middleware:

```python # src/serena/constants.py DASHBOARD_API_BASE_PORT = 0x5EDA # = 24282, always the same ```

```python # src/serena/dashboard.py — no auth, no CSRF, no Host header validation on any route @self._app.route("/save_memory", methods=["POST"]) def save_memory(): request_data = request.get_json() self._save_memory(...) # writes to disk, no credentials checked

@self._app.route("/shutdown", methods=["PUT"]) def shutdown(): self._agent.shutdown() # kills the agent, no credentials checked ```

Flask does not validate the `Host` header by default (no `SERVER_NAME` set), which is the prere…

Affected: PyPI: serena-agent

### Summary

Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282, hardcoded as `0x5EDA` in `constants.py`). The server has no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store — which the agent reads and acts on autonomously. Combined with `execute_shell_command` (enabled by default in all contexts via `shell=True`), this creates a full remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running.

### Details

**Root cause 1 — Unauthenticated dashboard (`src/serena/dashboard.py`)**

The Flask server starts automatically (`web_dashboard: true` by default) on a fixed, predictable port with no auth middleware:

```python # src/serena/constants.py DASHBOARD_API_BASE_PORT = 0x5EDA # = 24282, always the same ```

```python # src/serena/dashboard.py — no auth, no CSRF, no Host header validation on any route @self._app.route("/save_memory", methods=["POST"]) def save_memory(): request_data = request.get_json() self._save_memory(...) # writes to disk, no credentials checked

@self._app.route("/shutdown", methods=["PUT"]) def shutdown(): self._agent.shutdown() # kills the agent, no credentials checked ```

Flask does not validate the `Host` header by default (no `SERVER_NAME` set), which is the prere…