GitLab discloses a severe remote code execution vulnerability in the Serena MCP coding agent

GitLab's threat research group discovered a server-side template injection vulnerability in Serena (GHSA-pp25-4cg4-qcr9). An attacker can place a malicious .serena/project.yml in a repository they control, and arbitrary code executes when a developer opens that project with the Serena MCP server. This vulnerability bypasses Serena's trusted_project_path_patterns control, which is specifically designed to prevent untrusted repositories from running code, because the pattern loading and prompt rendering paths never go through the is_trusted() check. The researchers reproduced the bypass under the strictest configuration with trusted_project_path_patterns empty; activation_command was blocked while the template injection executed as usual, which is a protection mechanism failure (CWE-693).