PatchSiren

Metalama CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Metalama CVE published 2026-10-14

CVE-2026-62847

A local, unprivileged user on a shared machine or CI/build agent can exploit Metalama's predictable temporary directory structure to plant a malicious DLL, allowing for local code execution when a higher-privileged user subsequently runs a build. This vulnerability affects Metalama users on shared machines or CI/build agents, enabling potential privilege escalation. Defenders should prioritize verifying t [truncated]