MEDIUM 8.2 GitHub
CVE-2026-62847
Metalama allows local code execution through DLL planting in shared temporary directories
## Summary
Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory (`Path.GetTempPath()`, i.e. `/tmp`), and previously-generated artifacts were trusted based on the presence of a sentinel/`.completed` marker file rather than on any integrity verification.
A local, unprivileged user on a shared machine or
Affected Products
- nuget/Metalama.Framework >= 2026.1.0-preview, < 2026.1.19
- nuget/Metalama.Tool >= 2026.1.0-preview, < 2026.1.19
- nuget/Metalama.Framework < 2025.1.18
- nuget/Metalama.Tool < 2025.1.18
- nuget/Metalama.Tool >= 2026.0.0-preview, < 2026.0.25
- nuget/Metalama.Framework >= 2026.0.0-preview, < 2026.0.25
References
- https://github.com/advisories/GHSA-m6wq-39m7-9xpp
- https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp
- https://github.com/metalama/Metalama/pull/1719
- https://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9
This medium severity vulnerability with a CVSS score of 8.2 was published on 2026-10-14 via GitHub. Affected: nuget/Metalama.Framework >= 2026.1.0-preview, < 2026.1.19, nuget/Metalama.Tool >= 2026.1.0-preview, < 2026.1.19, nuget/Metalama.Framework < 2025.1.18 and 3 more.
vulnfeed aggregates 15189 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.