Local code execution in Metalama via DLL planting on Linux and macOS
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-427.
Summary
Metalama and its Metalama.Framework and Metalama.Tool packages are affected before 2025.1.18, from 2025.2.0-preview through 2025.2.5-rc, from 2026.0.0-preview before 2026.0.25, and from 2026.1.0-preview before 2026.1.19. On Linux and macOS, predictable temporary directories are world-writable and trusted based on marker files (CWE-427). A local user can plant a malicious DLL there, which then runs as a higher-privileged developer or build account during a build.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| metalama | Metalama | before 2025.1.18; 2025.2.0-preview – 2025.2.5-rc; 2026.0.0-preview to before 2026.0.25; 2026.1.0-preview to before 2026.1.19 | 2025.1.18, 2026.0.25, 2026.1.19 | Patch available | CNA |
| — | Metalama.Framework (NuGet) | 2026.1.0-preview to before 2026.1.19 | 2026.1.19 | Patch available | GHSA-m6wq-39m7-9xpp |
| — | Metalama.Tool (NuGet) | 2026.1.0-preview to before 2026.1.19 | 2026.1.19 | Patch available | GHSA-m6wq-39m7-9xpp |
| — | Metalama.Framework (NuGet) | before 2025.1.18 | 2025.1.18 | Patch available | GHSA-m6wq-39m7-9xpp |
| — | Metalama.Tool (NuGet) | before 2025.1.18 | 2025.1.18 | Patch available | GHSA-m6wq-39m7-9xpp |
| — | Metalama.Tool (NuGet) | 2026.0.0-preview to before 2026.0.25 | 2026.0.25 | Patch available | GHSA-m6wq-39m7-9xpp |
| — | Metalama.Framework (NuGet) | 2026.0.0-preview to before 2026.0.25 | 2026.0.25 | Patch available | GHSA-m6wq-39m7-9xpp |
- Metalama Vendormetalama Affected before 2025.1.18; 2025.2.0-preview – 2025.2.5-rc; 2026.0.0-preview to before 2026.0.25; 2026.1.0-preview to before 2026.1.19 Fixed in 2025.1.18, 2026.0.25, 2026.1.19 Patch available CNA
- Metalama.Framework (NuGet) Vendor— Affected 2026.1.0-preview to before 2026.1.19 Fixed in 2026.1.19 Patch available GHSA-m6wq-39m7-9xpp
- Metalama.Tool (NuGet) Vendor— Affected 2026.1.0-preview to before 2026.1.19 Fixed in 2026.1.19 Patch available GHSA-m6wq-39m7-9xpp
- Metalama.Framework (NuGet) Vendor— Affected before 2025.1.18 Fixed in 2025.1.18 Patch available GHSA-m6wq-39m7-9xpp
- Metalama.Tool (NuGet) Vendor— Affected before 2025.1.18 Fixed in 2025.1.18 Patch available GHSA-m6wq-39m7-9xpp
- Metalama.Tool (NuGet) Vendor— Affected 2026.0.0-preview to before 2026.0.25 Fixed in 2026.0.25 Patch available GHSA-m6wq-39m7-9xpp
- Metalama.Framework (NuGet) Vendor— Affected 2026.0.0-preview to before 2026.0.25 Fixed in 2026.0.25 Patch available GHSA-m6wq-39m7-9xpp
Remediation
Update Metalama, Metalama.Framework and Metalama.Tool to 2025.1.18, 2026.0.25 or 2026.1.19, depending on your release line.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA Metalama (metalama) Fixed in 2025.1.18, 2026.0.25, 2026.1.19
- Fix · GHSA-m6wq-39m7-9xpp Metalama.Framework (NuGet) Fixed in 2026.1.19 Advisory →
- Fix · GHSA-m6wq-39m7-9xpp Metalama.Tool (NuGet) Fixed in 2026.1.19 Advisory →
- Fix · GHSA-m6wq-39m7-9xpp Metalama.Framework (NuGet) Fixed in 2025.1.18 Advisory →
- Fix · GHSA-m6wq-39m7-9xpp Metalama.Tool (NuGet) Fixed in 2025.1.18 Advisory →
- Fix · GHSA-m6wq-39m7-9xpp Metalama.Tool (NuGet) Fixed in 2026.0.25 Advisory →
- Fix · GHSA-m6wq-39m7-9xpp Metalama.Framework (NuGet) Fixed in 2026.0.25 Advisory →
Timeline
- 2026-10-30 Threatist record created from CVE-2026-62847
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
References
Other 10
- https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp
- https://github.com/metalama/Metalama/pull/1650
- https://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9
- https://github.com/metalama/Metalama/commit/92c4feecfce86d18fcb007ab6d3a1b4383326a2e
- https://github.com/metalama/Metalama/releases/tag/release/2025.1.18
- https://github.com/metalama/Metalama/releases/tag/release/2026.0.25
- https://github.com/metalama/Metalama/releases/tag/release/2026.1.19
- https://github.com/metalama/Metalama/pull/1719
- https://github.com/metalama/Metalama/commit/ab9407263203c66d7c5680a34c28dba31f9951c9
- https://github.com/metalama/Metalama
More metalama vulnerabilities
- TI-2026-83389 Unsafe deserialization in Metalama lets local users run code CVSS 3.1HIGH 7.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences