Metalama.Framework CVE-2026-62848

Requires an attacker already running code as the same logged-in Windows user, and a running Visual Studio session that loads the affected Metalama integration - the Metalama.Framework design-time RPC (< 2026.1.19, and branch fixes 2025.1.18 / 2026.0.25), the maintained PostSharpTechnologies.PostSharp 'Metalama + PostSharp' extension 2024.1 through 2026.1.4, or the retired PostSharpTechnologies.Metalama or caravela extensions. The attacker must write to the named pipe Metalama_{role}_{processId}_{hash(PackageVersion)}, whose name is derivable from the public package version and a locally-enumerable process id. Limiting factors: the default Windows pipe ACL restricts writers to the same user (no privilege escalation, no boundary crossing), exploitation needs a developer actually running Visual Studio (UI:R), and command-line/MSBuild-only builds do not use the channel and are not exploitable. Earlier Metalama-free PostSharp versions (before the 2024.1 merge) are unaffected.

This is a CWE-502 unsafe-deserialization flaw in Metalama's Visual Studio named-pipe channel, scored CVSS 7.3 (High) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The local attack vector (AV:L) and PR:L are the dominant risk-limiters: the pipe is created with the default Windows ACL, so only same-user processes can write to it, meaning an attacker must already be executing code as the logged-in developer. There is no privilege escalation and no security boundary crossed, which is why the vendor explicitly rates practical severity as Medium despite the High base score - the real value to an attacker is lateral movement/persistence inside an already same-user-compromised session, not initial access. No EPSS score was provided and the CVE is not in CISA KEV, so there is no signal of widespread or active exploitation; exploitation status is 'no public exploit identified at time of analysis' (the supplied references are the advisory, fix PR #1651 and fix commits, not exploit code). The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patch-promptly-but-not-emergency posture. Signals are consistent rather than conflicting: high technical impact (C:H/I:H/A:H within the process) but constrained reach (local, same-user, requires a running VS session). Note the CVSS base score (7.3 High) overstates real-world urgency relative to the vendor's Medium practical rating because the base metric set does not credit the same-user precondition.

An attacker who already has code execution as the logged-in developer (e.g., commodity malware or another local same-user process) connects to Metalama's predictably-named Visual Studio named pipe (Metalama_{role}_{processId}_{hash(PackageVersion)}) while Visual Studio is open and sends a crafted message. Because the channel deserializes with Newtonsoft.Json TypeNameHandling.All (2023.0 through 2026.0.x) or typeless MessagePack (2026.1.0 through 2026.1.18) and instantiates arbitrary CLR types with no allow-list, a gadget chain yields arbitrary code execution inside the devenv, out-of-process Roslyn, or CodeLens process. No public exploit code was identified in the provided data, though the advisory itself notes the TypeNameHandling.All primitive has publicly available gadget chains (e.g., ysoserial.net).