{"id":"CVE-2026-62847","kind":"vulnerability","aliases":["CVE-2026-62847"],"related":[],"title":"Metalama: predictable temp directories let local users run planted code","description":"Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.","summary":"Metalama.Framework and Metalama.Tool trust compile-time DLLs in predictable temporary directories on Linux and macOS. A local unprivileged user can plant a malicious DLL that runs inside the compiler, IDE or MSBuild as a higher-privileged developer or build account.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","csharp","dotnet","linux","macos","metalama","package"],"not_affected_if":["fixed-version","single-user-machine","windows-default-temp"],"how_to_check":"- Check the Metalama.Framework and Metalama.Tool package versions in the project files and lockfiles\n- Check whether builds run on shared Linux or macOS machines or CI agents where other local users can write to the temp directory\n- Check whether the build process uses a non-default temp location: unknown","fix":"- Metalama.Framework and Metalama.Tool: move to `2025.1.18`, `2026.0.25` or `2026.1.19`, depending on the release line in use","status":"open","published_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:36+00:00","updated_at":"2026-10-30T21:26:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T21:26:36Z","model":"claude-haiku-5-5","output":{"fix":"- Metalama.Framework and Metalama.Tool: move to `2025.1.18`, `2026.0.25` or `2026.1.19`, depending on the release line in use","reach":"local","title":"Metalama: predictable temp directories let local users run planted code","impact":"high","summary":"Metalama.Framework and Metalama.Tool trust compile-time DLLs in predictable temporary directories on Linux and macOS. A local unprivileged user can plant a malicious DLL that runs inside the compiler, IDE or MSBuild as a higher-privileged developer or build account.","audience":"developers","category":"package","nicknames":[],"who_cares":["metalama","csharp","dotnet","linux","macos","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the building user, exposing source and secrets.","analyst_note":"","how_to_check":"- Check the Metalama.Framework and Metalama.Tool package versions in the project files and lockfiles\n- Check whether builds run on shared Linux or macOS machines or CI agents where other local users can write to the temp directory\n- Check whether the build process uses a non-default temp location: unknown","plain_action":"","needs_analyst":false,"not_affected_if":["windows-default-temp","single-user-machine","fixed-version"],"who_is_affected":"Teams building C# with Metalama on Linux or macOS, especially on shared machines or CI/build agents where a less-privileged local user can write to the default temp directory. Windows per-user temp directories are protected by ACLs and not affected, and insecure cache locations chosen by the deployer are outside the scope of the issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4450,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62847':13A,16A '2025.1.18':83C,248C '2026.0.25':84C,249C '2026.1.19':86C,251C 'account':65B,172C 'acl':225C 'affect':229C 'agent':146C 'architectur':77C 'artifact':122C,182C 'assembl':96C,103C 'auxiliari':97C 'base':71C,125C 'build':64B,171C,174C,192C,210C,214C 'c':80C 'cach':234C 'chain':207C 'ci':17B 'ci/build':145C 'code':10A 'compil':29B,53B,94C,185C 'compile-tim':28B,93C 'complet':129C 'creat':150C 'cross':197C 'cross-us':196C 'csharp':18B 'cve':11A,14A 'default':113C,215C 'deploy':231C 'deployer-select':230C 'determinist':152C 'develop':62B,169C 'directori':4A,35B,107C,153C,221C 'disrupt':213C 'dll':48B,159C 'dlls':31B 'dotnet':19B 'embed':101C 'escal':200C 'execut':92C,98C,179C 'exist':121C 'file':131C 'fix':245C 'helper':102C 'higher':60B,167C 'higher-privileg':59B,166C 'ide':54B,186C 'insecur':233C 'insid':51B 'integr':134C 'issu':243C 'let':5A 'linux':20B,37B,109C 'load':90C 'local':6A,41B,137C 'locat':115C,235C 'machin':143C 'maco':21B,39B,111C 'malici':47B,158C 'marker':130C 'match':162C 'metalama':1A,22B,66C,175C 'metalama.framework':24B,87C 'metalama.tool':26B,89C 'msbuild':56B,188C 'open':73C 'open-sourc':72C 'output':211C 'outsid':237C 'packag':23B 'path.gettemppath':114C 'pattern':75C 'per':218C 'per-us':217C 'permit':195C 'plant':9A,45B,156C,181C 'pre':149C 'pre-creat':148C 'predict':2A,33B,105C 'prior':81C 'privileg':61B,168C,199C 'process':189C 'protect':223C 'rather':132C 'read':201C 'regener':177C 'roslyn':70C 'roslyn-bas':69C 'run':8A,50B 'scope':241C 'secret':204C 'select':232C 'sentinel':127C,163C 'share':142C 'skip':176C 'sourc':74C,202C 'structur':154C 'subsequ':173C 'suppli':206C 'supply-chain':205C 'tamper':208C 'temp':3A 'temporari':34B,106C,220C 'time':30B,95C 'tool':99C 'toolkit':78C 'trust':27B,124C 'unprivileg':42B,138C 'user':7A,43B,139C,193C,198C,219C 'verif':135C 'version':247C 'vulner':239C 'window':216C 'world':118C 'world-writ':117C 'writabl':119C","nicknames":[],"mitigations":[],"who_affected":"Teams building C# with Metalama on Linux or macOS, especially on shared machines or CI/build agents where a less-privileged local user can write to the default temp directory. Windows per-user temp directories are protected by ACLs and not affected, and insecure cache locations chosen by the deployer are outside the scope of the issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62847","severity":null,"published_at":"2026-10-30T21:17:13+00:00","modified_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}