Metalama CVE-2026-62847
MEDIUM
GHSA-m6wq-39m7-9xpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged account on shared host
-
DeliveryPre-create deterministic Metalama temp cache directory
-
ExploitPlant malicious DLL plus matching .completed sentinel
-
ExecutionVictim runs Metalama build
-
PersistTool trusts sentinel and loads planted assembly
-
ImpactArbitrary code execution in victim's security context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Secure temp file creation
|
| Exploitation Conditions | Requires (1) an existing local, unprivileged user account on the SAME shared POSIX host (multi-user developer machine or CI/build agent); (2) the default configuration where Metalama's cache/extraction directory resolves to the world-writable system temp directory (Path.GetTempPath(), /tmp) on Linux or macOS - the |
| Impact | This is a genuine, well-characterized local privilege-escalation issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 8.2 High) is internally consistent with the description: exploitation requires an existing local, low-privilege account (PR:L), is local-only (AV:L), and depends on a victim subsequently running a build (UI:R). The Scope:Changed flag legitimately reflects cross-user compromise. The vendor's own CVSS 4.0 cross-check (6.0 Medium) is more conservative, attributing only low impact to the cache itself and high impact to the downstream build process - so the honest severity is a Medium-High range depending on scoring model and platform. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no signal of widespread or automated exploitation; realistic risk is confined to shared multi-user POSIX machines and CI/build agents where an attacker already has a foothold. Note the platform dependency: Linux/macOS default configurations are affected, while Windows defaults are explicitly NOT affected due to per-user temp ACLs - any risk rating must be qualified by platform. |
| Exploit ScenarioDerived | On a shared Linux build agent or multi-user developer macOS machine, an unprivileged attacker pre-creates Metalama's deterministic cache directory under the world-writable system temp directory (/tmp) and plants a malicious compile-time DLL alongside a matching |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Metalama allows an unprivileged user on a shared Linux or macOS host to plant a malicious .NET assembly in the world-writable system temp directory that will later be loaded and executed by a higher-privileged victim's build process. Metalama cached and extracted compile-time assemblies, auxiliary tools, and embedded helper assemblies under Path.GetTempPath() (/tmp) and trusted existing artifacts solely on a sentinel '.completed' marker file rather than any integrity check, so an attacker can pre-create the deterministic directory layout and rely on the marker to skip regeneration. Exploitation requires a pre-existing local account on the same shared machine or CI/build agent and a victim build initiated afterward; Windows default configurations are not affected because per-user temp ACLs prevent cross-user planting. No public exploit code has been identified at time of analysis and there is no KEV listing, but EPSS-style urgency is moderate given the low attack complexity and the availability of a vendor fix in 2026.1.19 (and 2025.1.18 on the older branch).
RemediationAI
Upgrade Metalama.Framework and Metalama.Tool to 2026.1.19 (or to 2025.1.18 if you remain on the 2025.1 branch); the fix relocates caches and extraction directories from the world-writable system temp directory to per-user application-data locations ($XDG_CACHE_HOME or ~/.cache/Metalama on POSIX), so OS-enforced per-user ownership becomes the trust boundary. Vendor-released patch: 2026.1.19 (and 2025.1.18 for the 2025.1 line), delivered via https://github.com/metalama/Metalama/pull/1719 and commits 09911349a916e82194b1cfaa6d0a38acad928fc9, 92c4feecfce86d18fcb007ab6d3a1b4383326a2e, and ab9407263203c66d7c5680a34c28dba31f9951c9; see https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp for details. If immediate upgrading is not possible, set the METALAMA_TEMP environment variable to a per-user, non-world-writable directory such as $HOME/.cache/Metalama with mode 0700 for every build, IDE, and service account, and verify the directory is not group- or other-writable - note the vendor considers an insecure METALAMA_TEMP value a misconfiguration, so this control only helps if the path is genuinely private to the invoking user. Because stale artifacts may already be planted, purge pre-existing Metalama cache and extraction directories from /tmp and any other shared temporary location before or immediately after the upgrade, and treat the build output of any build executed before remediation on a shared host as potentially tampered. On shared CI/build agents, run each user or job with a distinct, private per-user temporary directory (for example via TMPDIR or METALAMA_TEMP) or isolate jobs in containers or VMs with their own filesystems; the trade-off is increased per-user disk usage and recompilation of Metalama caches for each account. Restricting build agents to a single trusted user removes the cross-user attack primitive entirely, at the cost of reduced build concurrency.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in nuget
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Metalama is a .NET aspect-oriented compile-time metaprogramming framework shipped as the NuGet packages Metalama.Framework and Metalama.Tool, with supporting runtime infrastructure in Metalama.Backstage. To support aspect weaving it generates compile-time assemblies, extracts auxiliary executable tools, and extracts embedded .NET helper assemblies into a local cache/extraction directory, then loads and executes them inside the compiler, IDE, or MSBuild process (including via .NET remoting/JsonRpc). The root cause is the class of CWE-377 (Insecure Temporary File), compounded by CWE-427 (Uncontrolled Search Path Element): the default cache root resolved to the world-writable system temp directory (Path.GetTempPath(), i.e. /tmp) on Linux and macOS, and cache validity was determined only by the presence of a sentinel '.completed' marker file rather than by ownership, permissions, signature, or content hash verification. Because the directory structure and file names are deterministic, a local unprivileged user can pre-create the direct
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Local-only shared-host attack (AV:L) by an existing unprivileged account (PR:L) against deterministic paths (AC:L), needing the victim to run a build (UI:R); cross-user code execution yields S:C and full C/I/A:H.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Summary
Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory (Path.GetTempPath(), i.e. /tmp), and previously-generated artifacts were trusted based on the presence of a sentinel/.completed marker file rather than on any integrity verification.
A local, unprivileged user on a shared machine or CI/build agent can pre-create the deterministic cache directory structure and plant a malicious DLL together with the matching sentinel file. When a higher-privileged user (or build/service account) subsequently runs a build, Metalama finds the sentinel, skips regeneration, and loads and executes the attacker-supplied assembly inside the compiler / IDE / MSBuild process.
Affected load-and-execute paths:
- the cache of compile-time assemblies that Metalama generates from your aspects;
- auxiliary executable tools that Metalama extracts to a local directory and then launches;
- embedded .NET helper assemblies that Metalama extracts to a local directory and loads into the build / IDE process.
Impact
Arbitrary code execution in the security context of the building user - i.e. a local privilege escalation across user accounts on shared POSIX systems (multi-user developer machines, CI/build agents). The attacker obtains code execution as the victim without holding the victim's privileges, and can read source/secrets, tamper with build output (supply-chain injection), or disrupt builds.
Affected configurations
- Linux and macOS, default configuration - affected. The shipped default uses the world-writable system temp directory.
- Windows, default configuration - not affected. The default per-user temporary directory is protected by OS ACLs, so cross-user planting is not possible.
- The
METALAMA_TEMPenvironment variable is a deployer-controlled override and is out of scope: pointing it at an insecure (e.g. world-writable or attacker-owned) location is a deployment misconfiguration, not a defect in the product.
Severity
CVSS v3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 8.2 (High) for the affected POSIX default configuration (Scope:Changed reflects the cross-user privilege escalation).
CVSS v4.0 cross-check: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:H = 6.0 (Medium), which more granularly attributes low impact to the cache itself and high impact to the subsequent build process. The honest range is therefore Medium-High depending on the scoring model and platform.
Fix
Caches and extraction directories were relocated from the world-writable system temp directory to per-user application-data locations ($XDG_CACHE_HOME / ~/.cache/Metalama on POSIX), relying on OS-enforced per-user ownership as the trust boundary. Fixed in 2026.1.19.
Weaknesses
- CWE-377: Insecure Temporary File
- CWE-427: Uncontrolled Search Path Element
Affected packages
- Metalama.Framework < 2026.1.19,
- Metalama.Tool < 2026.1.19
Internal tracking: metalama/Metalama#1650.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB