Advisories for Nuget/Metalama.Framework package

2026

Metalama allows local code execution through DLL planting in shared temporary directories

Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory (Path.GetTempPath(), i.e. /tmp), and previously-generated artifacts were trusted based on the presence of a sentinel/.completed marker file rather than on any integrity verification. A local, unprivileged user on a shared machine or CI/build agent can pre-create the deterministic cache …