All vulnerabilities
CVE-2026-62847GHSA-m6wq-39m7-9xpp

Metalama.Framework: Metalama allows local code execution through DLL planting in shared temporary directories

Metalama.FrameworknugetLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2026.1.19Also 2025.1.18, 2026.0.25GitHub
Published14 Oct 2026Updated 14 Oct 2026GitHub

What fixes it

  • 2026.1.19Metalama.Framework, nugetGitHubdotnet add package Metalama.Framework --version 2026.1.19
  • 2026.1.19Metalama.Tool, nugetGitHubdotnet add package Metalama.Tool --version 2026.1.19
  • 2025.1.18Metalama.Framework, nugetGitHubdotnet add package Metalama.Framework --version 2025.1.18
  • 2025.1.18Metalama.Tool, nugetGitHubdotnet add package Metalama.Tool --version 2025.1.18
  • 2026.0.25Metalama.Tool, nugetGitHubdotnet add package Metalama.Tool --version 2026.0.25
  • 2026.0.25Metalama.Framework, nugetGitHubdotnet add package Metalama.Framework --version 2026.0.25
Show all 12 fixed versions
  • 2026.1.19Metalama.Framework, NuGetOSVdotnet add package Metalama.Framework --version 2026.1.19
  • 2026.1.19Metalama.Tool, NuGetOSVdotnet add package Metalama.Tool --version 2026.1.19
  • 2025.1.18Metalama.Framework, NuGetOSVdotnet add package Metalama.Framework --version 2025.1.18
  • 2025.1.18Metalama.Tool, NuGetOSVdotnet add package Metalama.Tool --version 2025.1.18
  • 2026.0.25Metalama.Tool, NuGetOSVdotnet add package Metalama.Tool --version 2026.0.25
  • 2026.0.25Metalama.Framework, NuGetOSVdotnet add package Metalama.Framework --version 2026.0.25

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory (Path.GetTempPath(), i.e. /tmp), and previously-generated artifacts were trusted based on the presence of a sentinel/.completed marker file rather than on any integrity verification.

A local, unprivileged user on a shared machine or CI/build agent can pre-create the deterministic cache directory structure and plant a malicious DLL together with the matching sentinel file. When a higher-privileged user (or build/service account) subsequently runs a build, Metalama finds the sentinel, skips regeneration, and loads and executes the attacker-supplied assembly inside the compiler / IDE / MSBuild process.

Affected load-and-execute paths:

  • the cache of compile-time assemblies that Metalama generates from your aspects;
  • auxiliary executable tools that Metalama extracts to a local directory and then launches;
  • embedded .NET helper assemblies that Metalama extracts to a local directory and loads into the build / IDE process.

Impact

Arbitrary code execution in the security context of the building user — i.e. a local privilege escalation across user accounts on shared POSIX systems (multi-user developer machines, CI/build agents). The attacker obtains code execution as the victim without holding the victim's privileges, and can read source/secrets, tamper with build output (supply-chain injection), or disrupt builds.

Affected configurations

  • Linux and macOS, default configuration — affected. The shipped default uses the world-writable system temp directory.
  • Windows, default configuration — not affected. The default per-user temporary directory is protected by OS ACLs, so cross-user planting is not possible.
  • The METALAMA_TEMP environment variable is a deployer-controlled override and is out of scope: pointing it at an insecure (e.g. world-writable or attacker-owned) location is a deployment misconfiguration, not a defect in the product.

Severity

CVSS v3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 8.2 (High) for the affected POSIX default configuration (Scope:Changed reflects the cross-user privilege escalation).

CVSS v4.0 cross-check: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:H = 6.0 (Medium), which more granularly attributes low impact to the cache itself and high impact to the subsequent build process. The honest range is therefore Medium-High depending on the scoring model and platform.

Fix

Caches and extraction directories were relocated from the world-writable system temp directory to per-user application-data locations ($XDG_CACHE_HOME / ~/.cache/Metalama on POSIX), relying on OS-enforced per-user ownership as the trust boundary. Fixed in 2026.1.19.

Weaknesses

  • CWE-377: Insecure Temporary File
  • CWE-427: Uncontrolled Search Path Element

Affected packages

  • Metalama.Framework < 2026.1.19,
  • Metalama.Tool < 2026.1.19

Internal tracking: metalama/Metalama#1650.

Text from GitHub Advisory Database

Affected versions 198

  • Metalama.Framework, nuget>= 2026.1.0-preview, < 2026.1.19GitHub
  • Metalama.Tool, nuget>= 2026.1.0-preview, < 2026.1.19GitHub
  • Metalama.Framework, nuget< 2025.1.18GitHub
  • Metalama.Tool, nuget< 2025.1.18GitHub
  • Metalama.Tool, nuget>= 2026.0.0-preview, < 2026.0.25GitHub
  • Metalama.Framework, nuget>= 2026.0.0-preview, < 2026.0.25GitHub
  • Metalama.Framework, NuGetfrom 2026.1.0-preview, fixed in 2026.1.19OSV
  • Metalama.Framework, NuGet2026.1.0-previewOSV
  • Metalama.Framework, NuGet2026.1.1-previewOSV
  • Metalama.Framework, NuGet2026.1.10-previewOSV
  • Metalama.Framework, NuGet2026.1.11-previewOSV
  • Metalama.Framework, NuGet2026.1.12-previewOSV
  • Metalama.Framework, NuGet2026.1.13-previewOSV
  • Metalama.Framework, NuGet2026.1.14-rcOSV
  • Metalama.Framework, NuGet2026.1.15-rcOSV
  • Metalama.Framework, NuGet2026.1.16OSV
  • Metalama.Framework, NuGet2026.1.17OSV
  • Metalama.Framework, NuGet2026.1.18OSV
  • Metalama.Framework, NuGet2026.1.2-previewOSV
  • Metalama.Framework, NuGet2026.1.3-previewOSV
  • Metalama.Framework, NuGet2026.1.4-previewOSV
  • Metalama.Framework, NuGet2026.1.5-previewOSV
  • Metalama.Framework, NuGet2026.1.6-previewOSV
  • Metalama.Framework, NuGet2026.1.7-previewOSV
  • Metalama.Framework, NuGet2026.1.8-previewOSV
  • Metalama.Framework, NuGet2026.1.9-previewOSV
  • Metalama.Tool, NuGetfrom 2026.1.0-preview, fixed in 2026.1.19OSV
  • Metalama.Tool, NuGet2026.1.0-previewOSV
  • Metalama.Tool, NuGet2026.1.1-previewOSV
  • Metalama.Tool, NuGet2026.1.10-previewOSV
  • Metalama.Tool, NuGet2026.1.11-previewOSV
  • Metalama.Tool, NuGet2026.1.12-previewOSV
  • Metalama.Tool, NuGet2026.1.13-previewOSV
  • Metalama.Tool, NuGet2026.1.14-rcOSV
  • Metalama.Tool, NuGet2026.1.15-rcOSV
  • Metalama.Tool, NuGet2026.1.16OSV
  • Metalama.Tool, NuGet2026.1.17OSV
  • Metalama.Tool, NuGet2026.1.18OSV
  • Metalama.Tool, NuGet2026.1.2-previewOSV
  • Metalama.Tool, NuGet2026.1.3-previewOSV
  • Metalama.Tool, NuGet2026.1.4-previewOSV
  • Metalama.Tool, NuGet2026.1.5-previewOSV
  • Metalama.Tool, NuGet2026.1.6-previewOSV
  • Metalama.Tool, NuGet2026.1.7-previewOSV
  • Metalama.Tool, NuGet2026.1.8-previewOSV
  • Metalama.Tool, NuGet2026.1.9-previewOSV
  • Metalama.Framework, NuGetfrom first release, fixed in 2025.1.18OSV
  • Metalama.Framework, NuGet0.5.0-previewOSV
  • Metalama.Framework, NuGet0.5.1-previewOSV
  • Metalama.Framework, NuGet0.5.10-previewOSV
  • Metalama.Framework, NuGet0.5.11-previewOSV
  • Metalama.Framework, NuGet0.5.12-previewOSV
  • Metalama.Framework, NuGet0.5.13-previewOSV
  • Metalama.Framework, NuGet0.5.15-previewOSV
  • Metalama.Framework, NuGet0.5.16-previewOSV
  • Metalama.Framework, NuGet0.5.17-previewOSV
  • Metalama.Framework, NuGet0.5.18-previewOSV
  • Metalama.Framework, NuGet0.5.19-previewOSV
  • Metalama.Framework, NuGet0.5.2-previewOSV
  • Metalama.Framework, NuGet0.5.20-previewOSV
  • Metalama.Framework, NuGet0.5.21-previewOSV
  • Metalama.Framework, NuGet0.5.22-previewOSV
  • Metalama.Framework, NuGet0.5.23-previewOSV
  • Metalama.Framework, NuGet0.5.24-previewOSV
  • Metalama.Framework, NuGet0.5.25-previewOSV
  • Metalama.Framework, NuGet0.5.26-previewOSV
  • Metalama.Framework, NuGet0.5.27-previewOSV
  • Metalama.Framework, NuGet0.5.28-previewOSV
  • Metalama.Framework, NuGet0.5.29-previewOSV
  • Metalama.Framework, NuGet0.5.3-previewOSV
  • Metalama.Framework, NuGet0.5.30-previewOSV
  • Metalama.Framework, NuGet0.5.31-previewOSV
  • Metalama.Framework, NuGet0.5.32-previewOSV
  • Metalama.Framework, NuGet0.5.33-previewOSV
  • Metalama.Framework, NuGet0.5.34-previewOSV
  • Metalama.Framework, NuGet0.5.35-previewOSV
  • Metalama.Framework, NuGet0.5.36-previewOSV
  • Metalama.Framework, NuGet0.5.37-previewOSV
  • Metalama.Framework, NuGet0.5.38-previewOSV
  • Metalama.Framework, NuGet0.5.39-previewOSV
  • Metalama.Framework, NuGet0.5.4-previewOSV
  • Metalama.Framework, NuGet0.5.40-previewOSV
  • Metalama.Framework, NuGet0.5.41-previewOSV
  • Metalama.Framework, NuGet0.5.42-previewOSV
  • Metalama.Framework, NuGet0.5.43-previewOSV
  • Metalama.Framework, NuGet0.5.44-previewOSV
  • Metalama.Framework, NuGet0.5.45-previewOSV
  • Metalama.Framework, NuGet0.5.46-previewOSV
  • Metalama.Framework, NuGet0.5.47-previewOSV
  • Metalama.Framework, NuGet0.5.48-previewOSV
  • Metalama.Framework, NuGet0.5.49-previewOSV
  • Metalama.Framework, NuGet0.5.5-previewOSV
  • Metalama.Framework, NuGet0.5.50-previewOSV
  • Metalama.Framework, NuGet0.5.51-previewOSV
  • Metalama.Framework, NuGet0.5.52-previewOSV
  • Metalama.Framework, NuGet0.5.53-previewOSV
  • Metalama.Framework, NuGet0.5.54-previewOSV
  • Metalama.Tool, NuGetfrom first release, fixed in 2025.1.18OSV
  • Metalama.Tool, NuGet0.5.77-previewOSV
  • Metalama.Tool, NuGet0.5.78-previewOSV
  • Metalama.Tool, NuGet0.5.79-previewOSV
  • Metalama.Tool, NuGet0.5.80-previewOSV
  • Metalama.Tool, NuGet0.5.81-previewOSV
  • Metalama.Tool, NuGet0.5.82-previewOSV
  • Metalama.Tool, NuGet0.5.83-previewOSV
  • Metalama.Tool, NuGet2023.0.101-rcOSV
  • Metalama.Tool, NuGet2023.0.102-rcOSV
  • Metalama.Tool, NuGet2023.0.103-rcOSV
  • Metalama.Tool, NuGet2023.0.104-rcOSV
  • Metalama.Tool, NuGet2023.0.105-rcOSV
  • Metalama.Tool, NuGet2023.0.106-rcOSV
  • Metalama.Tool, NuGet2023.0.107-rcOSV
  • Metalama.Tool, NuGet2023.0.108-rcOSV
  • Metalama.Tool, NuGet2023.0.109-rcOSV
  • Metalama.Tool, NuGet2023.0.110-rcOSV
  • Metalama.Tool, NuGet2023.0.111-rcOSV
  • Metalama.Tool, NuGet2023.0.112-rcOSV
  • Metalama.Tool, NuGet2023.0.113-rcOSV
  • Metalama.Tool, NuGet2023.0.114OSV
  • Metalama.Tool, NuGet2023.0.115OSV
  • Metalama.Tool, NuGet2023.0.116OSV
  • Metalama.Tool, NuGet2023.0.117OSV
  • Metalama.Tool, NuGet2023.0.118OSV
  • Metalama.Tool, NuGet2023.0.119OSV
  • Metalama.Tool, NuGet2023.0.120OSV
  • Metalama.Tool, NuGet2023.0.121OSV
  • Metalama.Tool, NuGet2023.1.1-previewOSV
  • Metalama.Tool, NuGet2023.1.10OSV
  • Metalama.Tool, NuGet2023.1.11OSV
  • Metalama.Tool, NuGet2023.1.12OSV
  • Metalama.Tool, NuGet2023.1.2-previewOSV
  • Metalama.Tool, NuGet2023.1.3-previewOSV
  • Metalama.Tool, NuGet2023.1.4-previewOSV
  • Metalama.Tool, NuGet2023.1.5-previewOSV
  • Metalama.Tool, NuGet2023.1.6-rcOSV
  • Metalama.Tool, NuGet2023.1.7-rcOSV
  • Metalama.Tool, NuGet2023.1.8-rcOSV
  • Metalama.Tool, NuGet2023.1.9OSV
  • Metalama.Tool, NuGet2023.2.1-previewOSV
  • Metalama.Tool, NuGet2023.2.2-rcOSV
  • Metalama.Tool, NuGet2023.2.3-rcOSV
  • Metalama.Tool, NuGet2023.2.4OSV
  • Metalama.Tool, NuGet2023.2.5OSV
  • Metalama.Tool, NuGet2023.3.1-previewOSV
  • Metalama.Tool, NuGet2023.3.10OSV
  • Metalama.Tool, NuGet2023.3.2-previewOSV
  • Metalama.Tool, NuGet2023.3.3-previewOSV
  • Metalama.Tool, NuGet2023.3.4-previewOSV
  • Metalama.Tool, NuGetfrom 2026.0.0-preview, fixed in 2026.0.25OSV
  • Metalama.Tool, NuGet2026.0.1-previewOSV
  • Metalama.Tool, NuGet2026.0.10-rcOSV
  • Metalama.Tool, NuGet2026.0.11OSV
  • Metalama.Tool, NuGet2026.0.12OSV
  • Metalama.Tool, NuGet2026.0.13OSV
  • Metalama.Tool, NuGet2026.0.14OSV
  • Metalama.Tool, NuGet2026.0.15OSV
  • Metalama.Tool, NuGet2026.0.16OSV
  • Metalama.Tool, NuGet2026.0.17OSV
  • Metalama.Tool, NuGet2026.0.18OSV
  • Metalama.Tool, NuGet2026.0.19OSV
  • Metalama.Tool, NuGet2026.0.2-previewOSV
  • Metalama.Tool, NuGet2026.0.20OSV
  • Metalama.Tool, NuGet2026.0.21OSV
  • Metalama.Tool, NuGet2026.0.22OSV
  • Metalama.Tool, NuGet2026.0.23OSV
  • Metalama.Tool, NuGet2026.0.24OSV
  • Metalama.Tool, NuGet2026.0.3-previewOSV
  • Metalama.Tool, NuGet2026.0.4-previewOSV
  • Metalama.Tool, NuGet2026.0.5-previewOSV
  • Metalama.Tool, NuGet2026.0.6-rcOSV
  • Metalama.Tool, NuGet2026.0.7-rcOSV
  • Metalama.Tool, NuGet2026.0.8-rcOSV
  • Metalama.Tool, NuGet2026.0.9-rcOSV
  • Metalama.Framework, NuGetfrom 2026.0.0-preview, fixed in 2026.0.25OSV
  • Metalama.Framework, NuGet2026.0.1-previewOSV
  • Metalama.Framework, NuGet2026.0.10-rcOSV
  • Metalama.Framework, NuGet2026.0.11OSV
  • Metalama.Framework, NuGet2026.0.12OSV
  • Metalama.Framework, NuGet2026.0.13OSV
  • Metalama.Framework, NuGet2026.0.14OSV
  • Metalama.Framework, NuGet2026.0.15OSV
  • Metalama.Framework, NuGet2026.0.16OSV
  • Metalama.Framework, NuGet2026.0.17OSV
  • Metalama.Framework, NuGet2026.0.18OSV
  • Metalama.Framework, NuGet2026.0.19OSV
  • Metalama.Framework, NuGet2026.0.2-previewOSV
  • Metalama.Framework, NuGet2026.0.20OSV
  • Metalama.Framework, NuGet2026.0.21OSV
  • Metalama.Framework, NuGet2026.0.22OSV
  • Metalama.Framework, NuGet2026.0.23OSV
  • Metalama.Framework, NuGet2026.0.24OSV
  • Metalama.Framework, NuGet2026.0.3-previewOSV
  • Metalama.Framework, NuGet2026.0.4-previewOSV
  • Metalama.Framework, NuGet2026.0.5-previewOSV
  • Metalama.Framework, NuGet2026.0.6-rcOSV
  • Metalama.Framework, NuGet2026.0.7-rcOSV
  • Metalama.Framework, NuGet2026.0.8-rcOSV
  • Metalama.Framework, NuGet2026.0.9-rcOSV

References 6