Metalama.Framework: Metalama allows local code execution through DLL planting in shared temporary directories (CVE-2026-62847)

Metalama.Framework versions prior to 2026.1.19 on Linux and macOS use the world-writable system temporary directory for caching compile-time assemblies, auxiliary tools, and embedded helper assemblies. The presence of a sentinel file causes Metalama to trust and load these artifacts without integrity verification. An unprivileged local user can pre-create the cache directory structure and plant malicious DLLs with matching sentinel files. When a higher-privileged user runs a build, Metalama loads and executes the attacker-supplied assemblies within the compiler or IDE process, leading to arbitrary code execution with the victim's privileges. Windows is not affected due to OS ACL protections on per-user temp directories. The vulnerability is fixed in version 2026.1.19 by moving caches to per-user application data locations, leveraging OS-enforced ownership.

Allows local privilege escalation on shared POSIX systems by enabling an unprivileged user to execute arbitrary code in the security context of a higher-privileged user running Metalama builds or IDE processes. This can lead to reading sensitive source code or secrets, tampering with build outputs, supply-chain injection, or disruption of build processes. Windows default configurations are not impacted. The CVSS v3.1 score is 8.2 (High), reflecting the cross-user privilege escalation and high impact on confidentiality, integrity, and availability.

A fix is available in Metalama.Framework and Metalama.Tool version 2026.1.19. Users should upgrade to this version or later to ensure caches and extraction directories are stored in per-user application data locations, preventing DLL planting attacks. No additional action is required if already running 2026.1.19 or later. Avoid configuring the METALAMA_TEMP environment variable to point to insecure or world-writable locations, as this is a deployment misconfiguration rather than a product defect.