CVE-2026-62847
Received Received - Intake

Privilege Escalation in Metalama via Malicious DLL Injection

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-62847

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
metalama Metalama < 2025.1.18
metalama Metalama >= 2025.2.0-preview, <= 2025.2.5-rc
metalama Metalama >= 2026.0.0-preview, < 2026.0.25
metalama Metalama >= 2026.1.0-preview, < 2026.1.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CWE-377 Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Metalama is a toolkit for C# that loads and executes compile-time assemblies from temporary directories. Prior to versions 2025.1.18, 2026.0.25, and 2026.1.19, it uses predictable temporary directories on Linux and macOS. A local attacker can plant malicious DLLs in these directories, which Metalama will execute when a higher-privileged user builds code, leading to privilege escalation or code execution.

Detection Guidance

Check for suspicious DLL files in temporary directories on Linux or macOS systems, particularly in paths returned by 'echo $TMPDIR' or 'echo $TMP'. Look for files with names matching Metalama's expected artifacts or unexpected sentinel files like '.completed'.

Impact Analysis

If you use Metalama on a shared Linux or macOS system, an attacker with local access could escalate privileges, read your source code or secrets, tamper with build outputs, or disrupt builds. Windows systems are not affected by default.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data (e.g., source code, secrets), violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations must ensure secure temporary directory handling to maintain compliance.

Mitigation Strategies

Upgrade Metalama to versions 2025.1.18, 2026.0.25, or 2026.1.19 or later. Ensure temporary directories are not world-writable and review permissions on shared systems. Avoid using insecure cache locations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart