6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-62847

CVE-2026-62847: Metalama allows local code execution through DLL planting in shared temporary directories

Summary

Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory (Path.GetTempPath(), i.e. /tmp), and previously-generated artifacts were trusted based on the presence of a sentinel/.completed marker file rather than on any integrity verification.

A local, unprivileged user on a shared machine or CI/build agent can pre-create the deterministic cache directory structure and plant a malicious DLL together with the matching sentinel file. When a higher-privileged user (or build/service account) subsequently runs a build, Metalama finds the sentinel, skips regeneration, and loads and executes the attacker-supplied assembly inside the compiler / IDE / MSBuild process.

Affected load-and-execute paths:

the cache of compile-time assemblies that Metalama generates from your aspects;
auxiliary executable tools that Metalama extracts to a local directory and then launches;
embedded .NET helper assemblies that Metalama extracts to a local directory and loads into the build / IDE process.

Impact

Arbitrary code execution in the security context of the building user — i.e. a local privilege escalation across user accounts on shared POSIX systems (multi-user developer machines, CI/build agents). The attacker obtains code execution as the victim without holding the victim's privileges, and can read source/secrets, tamper with build output (supply-chain injection), or disrupt builds.

Affected configurations

Linux and macOS, default configuration — affected. The shipped default uses the world-writable system temp directory.
Windows, default configuration — not affected. The default per-user temporary directory is protected by OS ACLs, so cross-user planting is not possible.
The METALAMA_TEMP environment variable is a deployer-controlled override and is : pointing it at an insecure (e.g. world-writable or attacker-owned) location is a deployment misconfiguration, not a defect in the product.

Miggo Vulnerability Database

→

CVE-2026-62847

CVE-2026-62847:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Metalama.Framework	nuget	>= 2026.1.0-preview, < 2026.1.19	2026.1.19
Metalama.Tool	nuget	>= 2026.1.0-preview, < 2026.1.19	2026.1.19
Metalama.Framework	nuget	< 2025.1.18	2025.1.18
Metalama.Tool	nuget	< 2025.1.18	2025.1.18
Metalama.Tool	nuget	>= 2026.0.0-preview, < 2026.0.25	2026.0.25
Metalama.Framework	nuget	>= 2026.0.0-preview, < 2026.0.25	2026.0.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2026-62847, also tracked as GHSA-m6wq-39m7-9xpp, describes a DLL planting issue in Metalama on Linux and macOS. The root cause is the use of Path.GetTempPath() which, on these operating systems, resolves to the world-writable /tmp directory. This allows a local, unprivileged attacker to pre-create Metalama's temporary directories and plant malicious assemblies or executables. When a higher-privileged user or build process subsequently runs, Metalama trusts these pre-existing artifacts and loads/executes the attacker's code, leading to local privilege escalation.

The analysis of the provided GitHub commits (specifically 09911349a916e82194b1cfaa6d0a38acad928fc9 and 92c4feecfce86d18fcb007ab6d3a1b4383326a2e) clearly shows the changes made to address this. The key modifications involve:

Metalama.Backstage.Utilities.MetalamaPathUtilities.GetTempPath(): This static utility method was the direct source of the insecure temporary path. The patch explicitly marks it as obsolete and warns against its use due to the /tmp issue on Unix. Any code calling this function in the vulnerable version would be exposed.
Metalama.Backstage.Infrastructure.StandardDirectories.get_TempDirectory(): This property's getter was directly constructing the temporary directory path using MetalamaPathUtilities.GetTempPath(). The fix introduces conditional logic to use a secure, per-user application data directory on Unix-like systems, while retaining the existing behavior for Windows (where Path.GetTempPath() is already secure).
Metalama.Framework.CompilerExtensions.ResourceExtractor.GetTempDirectory(string): This method, crucial for extracting and launching auxiliary tools, also relied on the insecure temporary path. The patch refactors this to use a new GetTempBaseDirectory() method that mirrors the secure path determination logic, ensuring that extracted executables are placed in a protected location.

These functions are directly involved in determining and using the insecure temporary file locations, making them the primary vulnerable points that would appear in a runtime profile during an exploitation attempt.

Vulnerable functions

Metalama.Backstage.Utilities.MetalamaPathUtilities.GetTempPath()

Metalama.Backstage/src/Metalama.Backstage/Utilities/MetalamaPathUtilities.cs

This function directly returned the system's temporary path, which on Unix-like systems (Linux, macOS) defaults to `/tmp`. This directory is world-writable, allowing a local attacker to pre-create the Metalama temporary directory structure and plant malicious DLLs or executables. When Metalama subsequently used this path, it would load and execute the attacker-supplied code.

Metalama.Backstage.Infrastructure.StandardDirectories.get_TempDirectory()

Metalama.Backstage/src/Metalama.Backstage/Infrastructure/StandardDirectories.cs

Before the fix, the getter for the `TempDirectory` property relied on `MetalamaPathUtilities.GetTempPath()` to determine the base temporary directory. This meant that on Unix-like systems, it would construct a path within the world-writable `/tmp` directory, making it susceptible to DLL planting for compile-time assemblies and other general temporary files.

Metalama.Framework.CompilerExtensions.ResourceExtractor.GetTempDirectory(string)

Metalama.Framework/src/Metalama.Framework.CompilerExtensions/ResourceExtractor.cs

This function was responsible for determining the temporary directory where auxiliary executable tools and embedded helper assemblies were extracted. Prior to the fix, it used `Path.GetTempPath()` (or an overridden path) as its base, leading to the creation of temporary directories in world-writable locations on Unix-like systems. This allowed attackers to plant malicious executables that Metalama would then launch.