Summary
Serena renders per-project mode/context prompt fields as Jinja2 templates using a non-sandboxed jinja2.Environment(). A project can pull in an attacker-authored mode file via a path-like added_modes entry in its .serena/project.yml, and that mode's prompt string is compiled and rendered during system-prompt construction on project activation. Because the environment is unsandboxed, the prompt string can carry a standard Jinja SSTI gadget and achieve arbitrary code execution in the Serena process, on stock defaults (LSP backend, desktop-app context), with no network, no authentication, and no tool call.
Crucially, this path is not covered by trusted_project_path_patterns / is_trusted() — the control Serena built specifically to stop untrusted projects from executing code (it gates activation_command and ls_specific_settings). We empirically confirmed that on an untrusted project (trusted_project_path_patterns = []), activation_command is correctly blocked while this SSTI still executes. It is therefore a bypass of Serena's own untrusted-project protection, not the documented "the repository being worked on is trusted" assumption.
Summary
Serena renders per-project mode/context
promptfields as Jinja2 templates using a non-sandboxedjinja2.Environment(). A project can pull in an attacker-authored mode file via a path-likeadded_modesentry in its.serena/project.yml, and that mode'spromptstring is compiled and rendered during system-prompt construction on project activation. Because the environment is unsandboxed, the prompt string can carry a standard Jinja SSTI gadget and achieve arbitrary code execution in the Serena process, on stock defaults (LSP backend,desktop-appcontext), with no network, no authentication, and no tool call.Crucially, this path is not covered by
trusted_project_path_patterns/is_trusted()— the control Serena built specifically to stop untrusted projects from executing code (it gatesactivation_commandandls_specific_settings). We empirically confirmed that on an untrusted project (trusted_project_path_patterns = []),activation_commandis correctly blocked while this SSTI still executes. It is therefore a bypass of Serena's own untrusted-project protection, not the documented "the repository being worked on is trusted" assumption.