{"id":"EUVD-2026-114452","enisaUuid":"f7eceab4-b345-32b5-a223-7325d2ff84a9","description":"Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability\u0027s scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.","datePublished":"Oct 30, 2026, 8:23:50 PM","dateUpdated":"Oct 30, 2026, 10:13:12 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp\nhttps://github.com/metalama/Metalama/pull/1650\nhttps://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9\nhttps://github.com/metalama/Metalama/commit/92c4feecfce86d18fcb007ab6d3a1b4383326a2e\nhttps://github.com/metalama/Metalama/releases/tag/release/2025.1.18\nhttps://github.com/metalama/Metalama/releases/tag/release/2026.0.25\nhttps://github.com/metalama/Metalama/releases/tag/release/2026.1.19\n","aliases":"CVE-2026-62847\nGHSA-m6wq-39m7-9xpp\n","assigner":"GitHub_M","epss":0.15,"enisaIdProduct":[{"id":"20ef5848-6249-3ca9-9c38-438b7f351d45","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"2025.2.0-preview, ≤ 2025.2.5-rc"},{"id":"5ef9ff54-af26-3d2d-ae1e-00ce757dc9fe","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"2026.1.0-preview, \u003c 2026.1.19"},{"id":"a8ed92ac-b291-3e45-97f2-29ac5e715329","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"\u003c 2025.1.18"},{"id":"d8c0895d-f866-3828-9157-f0b886c7a9bf","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"2026.0.0-preview, \u003c 2026.0.25"}],"enisaIdVendor":[{"id":"142b98c4-67d6-3e8f-9078-92389e98712c","vendor":{"name":"metalama"}}],"enisaIdVulnerability":[{"id":"05cebf8e-a5da-373d-9d5a-02bcdf58731c","vulnerability":{"id":"GHSA-m6wq-39m7-9xpp","description":"Metalama allows local code execution through DLL planting in shared temporary directories","datePublished":"Oct 14, 2026, 7:24:53 PM","dateUpdated":"Oct 14, 2026, 7:24:53 PM","baseScore":0.0,"references":"https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp\nhttps://github.com/metalama/Metalama/pull/1719\nhttps://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9\nhttps://github.com/metalama/Metalama/commit/92c4feecfce86d18fcb007ab6d3a1b4383326a2e\nhttps://github.com/metalama/Metalama/commit/ab9407263203c66d7c5680a34c28dba31f9951c9\nhttps://github.com/metalama/Metalama\n","enisa_id":"EUVD-2026-114452\n","aliases":"GHSA-m6wq-39m7-9xpp\nCVE-2026-62847\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"58dbc974-bea4-3c64-8b96-12cdd16127f9","vulnerability":{"id":"CVE-2026-62847","description":"Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability\u0027s scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.","datePublished":"Oct 30, 2026, 8:23:50 PM","dateUpdated":"Oct 30, 2026, 10:13:12 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp\nhttps://github.com/metalama/Metalama/pull/1650\nhttps://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9\nhttps://github.com/metalama/Metalama/commit/92c4feecfce86d18fcb007ab6d3a1b4383326a2e\nhttps://github.com/metalama/Metalama/releases/tag/release/2025.1.18\nhttps://github.com/metalama/Metalama/releases/tag/release/2026.0.25\nhttps://github.com/metalama/Metalama/releases/tag/release/2026.1.19\n","enisa_id":"EUVD-2026-114452\n","assigner":"GitHub_M","epss":0.15,"dataProcessed":"Nov 1, 2026, 1:00:30 PM","vulnerabilityProduct":[{"id":"02fc7b7d-ea0e-36c4-a5a7-296d507c8948","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"2026.0.0-preview, \u003c 2026.0.25"},{"id":"5eac11b5-1af8-3ad6-bb31-44075e86b493","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"\u003c 2025.1.18"},{"id":"d1ec2edf-9578-33ac-b469-f2ea76281d98","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"2025.2.0-preview, ≤ 2025.2.5-rc"},{"id":"db3331b0-611f-3de5-bcec-9680e1137fae","product":{"name":"Metalama","vendor":{"name":"metalama"}},"product_version":"2026.1.0-preview, \u003c 2026.1.19"}],"vulnerabilityVendor":[{"id":"65d303b8-eeec-3ef0-962c-413e07137ca7","vendor":{"name":"metalama"}}]}}],"enisaIdAdvisory":[]}