EUVD-2026-114449

Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution...

CVE-2026-62848

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

CVE-2026-62847

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary...

CVE-2026-62847 Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary...

CVE-2026-62848

The Metalama Roslyn-based toolkit for C# contains an unsafe deserialization vulnerability in its Windows Visual Studio integration. The issue stems from the software's failure to restrict CLR types during the deserialization of local named-pipe messages between the devenv, out-of-process Roslyn c...

CVE-2026-62848 Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

CVE-2026-62848

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

CVE-2026-62848 Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

CVE-2026-62847: Metalama: Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary...

PT-2026-134194

Name of the Vulnerable Software and Affected Versions Metalama versions 2023.0.101-rc through 2025.1.17 Metalama versions 2026.0.x through 2026.0.24 Metalama versions 2026.1.0 through 2026.1.18 Metalama + PostSharp extension versions 2024.1 through 2026.1.4 Metalama extension affected versions no...

CVE-2026-62848: Metalama: Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

Metalama allows local code execution through DLL planting in shared temporary directories

Summary Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory Path.GetTempPath, i.e. /tmp, and...

GHSA-M6WQ-39M7-9XPP Metalama allows local code execution through DLL planting in shared temporary directories

Summary Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory Path.GetTempPath, i.e. /tmp, and...

PT-2026-114418

Name of the Vulnerable Software and Affected Versions Metalama.Framework versions prior to 2026.1.19 Metalama.Tool versions prior to 2026.1.19 Description Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from...