CVE-2026-62847 Metalama CVE debrief

Who should care

Defenders responsible for securing shared machines or CI/build agents, as well as developers using Metalama, should assess exposure and prioritize updates to mitigate this vulnerability.

Why it matters

This vulnerability allows local code execution through DLL planting in shared temporary directories, affecting Metalama users on shared machines or CI/build agents. Defenders should prioritize verifying temporary directory integrity, ensuring proper access controls, and updating Metalama to mitigate this vulnerability.

• Local code execution can occur when a higher-privileged user runs a build, allowing for potential privilege escalation.
• The vulnerability can be exploited by a local, unprivileged user on a shared machine or CI/build agent.
• Verification of temporary directory integrity and access controls is necessary to mitigate this vulnerability.
• Updating Metalama to version 2026.1.19 or later is required to fix this vulnerability.

Technical summary

Metalama loads and executes compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. A local, unprivileged user can pre-create the deterministic cache directory structure and plant a malicious DLL together with a matching sentinel file. When a higher-privileged user subsequently runs a build, Metalama finds the sentinel, skips regeneration, and loads and executes the attacker-supplied assembly.

Defensive priority

Defenders should prioritize verifying the integrity of temporary directories, ensuring proper access controls, and updating Metalama to version 2026.1.19 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the integrity of temporary directories used by Metalama
• Ensure proper access controls are in place for shared machines or CI/build agents
• Update Metalama to version 2026.1.19 or later
• Monitor for suspicious activity in temporary directories
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and fixed versions of Metalama. However, the corpus does not establish versions, exploitation, impact, or remediation beyond what is provided, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.