Summary
CVE-2026-62848 affects Metalama, an open-source Roslyn-based patterns and architecture toolkit for C#. It was published to the NVD on October 30, 2026 with a CVSS score of 7.3.
Details
From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. Unsafe deserialization of this kind lets a process able to write to the pipe cause attacker-chosen types to be instantiated inside the Visual Studio-side process.
| Item | Value |
|---|---|
| CVE | CVE-2026-62848 |
| CVSS | 7.3 |
| Vector | Local named pipe |
| Affected | Metalama Visual Studio integration on Windows, versions listed above |
Impact
A local, lower-privileged process on a developer workstation or build host could run code in the context of the developer's Visual Studio session, reaching source code, signing material and cloud credentials.
Remediation
- Update Metalama to a release newer than the affected builds; check the project's security advisory for the exact fixed versions.
- Until updated, avoid running untrusted processes on machines where the Metalama Visual Studio extension is active, including shared build hosts.
- Inventory developer workstations and CI agents that have the extension installed.