CVE-2026-62848 with a CVSS score of 7.3 is a local unsafe deserialization vulnerability in Metalama's Visual Studio inter-process named pipe channel, where messages are deserialized without restricting which CLR types can be instantiated. The affected component is the Visual Studio integration used by the UI, out-of-process Roslyn code-analysis, and CodeLens processes on Windows. The vulnerability affects the Metalama.Framework NuGet package and associated maintained and retired Visual Studio extensions. Exploitation requires a local attacker process running as the same logged-in user to write a crafted message to the predictable pipe name, causing arbitrary .NET type instantiation and a deserialization primitive comparable to BinaryFormatter. The attacker does not need elevated privileges, but user interaction is required because the vulnerable channel is used only by the Visual Studio integration, not command-line or MSBuild builds. Business impact is arbitrary code execution inside the affected Visual Studio process, causing full loss of confidentiality, integrity, and availability within that process and enabling lateral movement or persistence in an already same-user compromised development environment.
We recommend you to update Metalama.Framework to version 2026.1.19, 2025.1.18 or 2026.0.25 or later.[/subscribe_to_unlock_form]
CVE-2026-62848 with a CVSS score of 7.3 is a local unsafe deserialization vulnerability in Metalama's Visual Studio inter-process named pipe channel, where messages are deserialized without restricting which CLR types can be instantiated. The affected component is the Visual Studio integration used by the UI, out-of-process Roslyn code-analysis, and CodeLens processes on Windows. The vulnerability affects the Metalama.Framework NuGet package and associated maintained and retired Visual Studio extensions. Exploitation requires a local attacker process running as the same logged-in user to write a crafted message to the predictable pipe name, causing arbitrary .NET type instantiation and a deserialization primitive comparable to BinaryFormatter. The attacker does not need elevated privileges, but user interaction is required because the vulnerable channel is used only by the Visual Studio integration, not command-line or MSBuild builds. Business impact is arbitrary code execution inside the affected Visual Studio process, causing full loss of confidentiality, integrity, and availability within that process and enabling lateral movement or persistence in an already same-user compromised development environment.
We recommend you to update Metalama.Framework to version 2026.1.19, 2025.1.18 or 2026.0.25 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]