ghsa-h26j-4vp7-x9w2

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Metalama.Framework",
        "purl": "pkg:nuget/Metalama.Framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.1.0-preview"
            },
            {
              "fixed": "2026.1.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2026.1.0-preview",
        "2026.1.1-preview",
        "2026.1.10-preview",
        "2026.1.11-preview",
        "2026.1.12-preview",
        "2026.1.13-preview",
        "2026.1.14-rc",
        "2026.1.15-rc",
        "2026.1.16",
        "2026.1.17",
        "2026.1.18",
        "2026.1.2-preview",
        "2026.1.3-preview",
        "2026.1.4-preview",
        "2026.1.5-preview",
        "2026.1.6-preview",
        "2026.1.7-preview",
        "2026.1.8-preview",
        "2026.1.9-preview"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Metalama.Framework",
        "purl": "pkg:nuget/Metalama.Framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2025.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.5.0-preview",
        "0.5.1-preview",
        "0.5.10-preview",
        "0.5.11-preview",
        "0.5.12-preview",
        "0.5.13-preview",
        "0.5.15-preview",
        "0.5.16-preview",
        "0.5.17-preview",
        "0.5.18-preview",
        "0.5.19-preview",
        "0.5.2-preview",
        "0.5.20-preview",
        "0.5.21-preview",
        "0.5.22-preview",
        "0.5.23-preview",
        "0.5.24-preview",
        "0.5.25-preview",
        "0.5.26-preview",
        "0.5.27-preview",
        "0.5.28-preview",
        "0.5.29-preview",
        "0.5.3-preview",
        "0.5.30-preview",
        "0.5.31-preview",
        "0.5.32-preview",
        "0.5.33-preview",
        "0.5.34-preview",
        "0.5.35-preview",
        "0.5.36-preview",
        "0.5.37-preview",
        "0.5.38-preview",
        "0.5.39-preview",
        "0.5.4-preview",
        "0.5.40-preview",
        "0.5.41-preview",
        "0.5.42-preview",
        "0.5.43-preview",
        "0.5.44-preview",
        "0.5.45-preview",
        "0.5.46-preview",
        "0.5.47-preview",
        "0.5.48-preview",
        "0.5.49-preview",
        "0.5.5-preview",
        "0.5.50-preview",
        "0.5.51-preview",
        "0.5.52-preview",
        "0.5.53-preview",
        "0.5.54-preview",
        "0.5.55-preview",
        "0.5.56-preview",
        "0.5.57-preview",
        "0.5.58-preview",
        "0.5.59-preview",
        "0.5.6-preview",
        "0.5.60-preview",
        "0.5.61-preview",
        "0.5.62-preview",
        "0.5.63-preview",
        "0.5.64-preview",
        "0.5.65-preview",
        "0.5.66-preview",
        "0.5.67-preview",
        "0.5.68-preview",
        "0.5.69-preview",
        "0.5.7-preview",
        "0.5.70-preview",
        "0.5.71-preview",
        "0.5.72-preview",
        "0.5.73-preview",
        "0.5.74-preview",
        "0.5.75-preview",
        "0.5.76-preview",
        "0.5.77-preview",
        "0.5.78-preview",
        "0.5.79-preview",
        "0.5.8-preview",
        "0.5.80-preview",
        "0.5.81-preview",
        "0.5.82-preview",
        "0.5.83-preview",
        "0.5.9-preview",
        "2023.0.101-rc",
        "2023.0.102-rc",
        "2023.0.103-rc",
        "2023.0.104-rc",
        "2023.0.105-rc",
        "2023.0.106-rc",
        "2023.0.107-rc",
        "2023.0.108-rc",
        "2023.0.109-rc",
        "2023.0.110-rc",
        "2023.0.111-rc",
        "2023.0.112-rc",
        "2023.0.113-rc",
        "2023.0.114",
        "2023.0.115",
        "2023.0.116",
        "2023.0.117",
        "2023.0.118",
        "2023.0.119",
        "2023.0.120",
        "2023.0.121",
        "2023.1.1-preview",
        "2023.1.10",
        "2023.1.11",
        "2023.1.12",
        "2023.1.2-preview",
        "2023.1.3-preview",
        "2023.1.4-preview",
        "2023.1.5-preview",
        "2023.1.6-rc",
        "2023.1.7-rc",
        "2023.1.8-rc",
        "2023.1.9",
        "2023.2.1-preview",
        "2023.2.2-rc",
        "2023.2.3-rc",
        "2023.2.4",
        "2023.2.5",
        "2023.3.1-preview",
        "2023.3.10",
        "2023.3.2-preview",
        "2023.3.3-preview",
        "2023.3.4-preview",
        "2023.3.5-rc",
        "2023.3.6-rc",
        "2023.3.7-rc",
        "2023.3.8",
        "2023.3.9",
        "2023.4.1-preview",
        "2023.4.2-preview",
        "2023.4.3-preview",
        "2023.4.4-preview",
        "2023.4.5-rc",
        "2023.4.6",
        "2023.4.7",
        "2023.4.8",
        "2023.4.9",
        "2024.0.1-preview",
        "2024.0.10",
        "2024.0.11",
        "2024.0.12",
        "2024.0.13",
        "2024.0.14",
        "2024.0.15",
        "2024.0.16",
        "2024.0.2-preview",
        "2024.0.3-preview",
        "2024.0.4-rc",
        "2024.0.5-rc",
        "2024.0.6",
        "2024.0.7",
        "2024.0.8",
        "2024.0.9",
        "2024.1.1-preview",
        "2024.1.10-rc",
        "2024.1.11-rc",
        "2024.1.12",
        "2024.1.13",
        "2024.1.14",
        "2024.1.15",
        "2024.1.16",
        "2024.1.17",
        "2024.1.18",
        "2024.1.19",
        "2024.1.2-preview",
        "2024.1.20",
        "2024.1.21",
        "2024.1.22",
        "2024.1.23",
        "2024.1.24",
        "2024.1.25",
        "2024.1.26",
        "2024.1.27",
        "2024.1.28",
        "2024.1.29",
        "2024.1.3-preview",
        "2024.1.30",
        "2024.1.4-preview",
        "2024.1.5-preview",
        "2024.1.6-preview",
        "2024.1.7-preview",
        "2024.1.8-preview",
        "2024.1.9-rc",
        "2024.2.1-preview",
        "2024.2.10-preview",
        "2024.2.11-preview",
        "2024.2.12-preview",
        "2024.2.13-rc",
        "2024.2.14-rc",
        "2024.2.15-rc",
        "2024.2.16-rc",
        "2024.2.17-rc",
        "2024.2.18",
        "2024.2.19",
        "2024.2.2-preview",
        "2024.2.20",
        "2024.2.21",
        "2024.2.22",
        "2024.2.23",
        "2024.2.24",
        "2024.2.25",
        "2024.2.26",
        "2024.2.27",
        "2024.2.28",
        "2024.2.29",
        "2024.2.3-preview",
        "2024.2.30",
        "2024.2.31",
        "2024.2.32",
        "2024.2.4-preview",
        "2024.2.5-preview",
        "2024.2.6-preview",
        "2024.2.7-preview",
        "2024.2.8-preview",
        "2024.2.9-preview",
        "2025.0.1-preview",
        "2025.0.10",
        "2025.0.11",
        "2025.0.12",
        "2025.0.2-preview",
        "2025.0.3-preview",
        "2025.0.4-preview",
        "2025.0.5-preview",
        "2025.0.6-rc",
        "2025.0.7-rc",
        "2025.0.8",
        "2025.0.9",
        "2025.1.1-preview",
        "2025.1.10",
        "2025.1.11",
        "2025.1.12",
        "2025.1.13",
        "2025.1.14",
        "2025.1.15",
        "2025.1.16",
        "2025.1.17",
        "2025.1.2-preview",
        "2025.1.3-rc",
        "2025.1.4-rc",
        "2025.1.5",
        "2025.1.6",
        "2025.1.7",
        "2025.1.8",
        "2025.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Metalama.Framework",
        "purl": "pkg:nuget/Metalama.Framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.0.1-preview"
            },
            {
              "fixed": "2026.0.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2026.0.1-preview",
        "2026.0.10-rc",
        "2026.0.11",
        "2026.0.12",
        "2026.0.13",
        "2026.0.14",
        "2026.0.15",
        "2026.0.16",
        "2026.0.17",
        "2026.0.18",
        "2026.0.19",
        "2026.0.2-preview",
        "2026.0.20",
        "2026.0.21",
        "2026.0.22",
        "2026.0.23",
        "2026.0.24",
        "2026.0.3-preview",
        "2026.0.4-preview",
        "2026.0.5-preview",
        "2026.0.6-rc",
        "2026.0.7-rc",
        "2026.0.8-rc",
        "2026.0.9-rc"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62848"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-03T16:37:44Z",
    "nvd_published_at": "2026-10-30T21:17:13Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMetalama uses a local named-pipe channel to communicate between its Visual Studio processes — the Visual Studio UI process (`devenv`), the out-of-process Roslyn code-analysis process, and the CodeLens process. This channel deserialized messages from the pipe **without restricting which CLR types could be instantiated**. A local process able to write to the pipe can send a crafted message that instantiates arbitrary .NET types — a deserialization primitive in the same class as `BinaryFormatter` (CWE-502), and a well-known gadget-chain code-execution vector.\n\nThe flaw is present, via two successive serializers, in **every Metalama release from the first public version (2023.0) up to and including 2026.1.18**, and is fixed in **2026.1.19**.\n\nThe pipe name is predictable: `Metalama_{role}_{processId}_{hash(PackageVersion)}`, derived from the public package version and a locally-enumerable process id. This channel is used by the Visual Studio integration only (Windows named pipes); it is not used for command-line / MSBuild builds.\n\n## Mechanisms\n\n**JSON era — Metalama 2023.0 through 2026.0.x (Newtonsoft.Json).** The pipe formatter enabled polymorphic type embedding:\n```csharp\nformatter.JsonSerializer.TypeNameHandling = TypeNameHandling.All;   // ServiceEndpoint.cs (early), later BaseEndpoint.cs\n```\nThe accompanying `SerializationBinder` (added later for multi-version assembly support) only **remapped assembly names**; its `BindToType` resolved **any** type name from the wire (`assembly.GetType(typeName)`) with **no type allow-list**. `TypeNameHandling.All` is the canonical unsafe-deserialization setting and has publicly available gadget chains (e.g. ysoserial.net), so this era is at least as exploitable as the later one. (Introduced by commit `0554368737`, first shipped in `release/2023.0.101-rc`.)\n\n**MessagePack era — Metalama 2026.1.0 through 2026.1.18.** The 2026.1 line migrated the pipe serialization to MessagePack (PR #1299, commit `117b607805`, 2026-01-29), using **typeless** MessagePack (`TypelessObjectResolver`), which likewise embeds CLR type names on the wire and instantiates arbitrary types on receipt — again with no allow-list.\n\nBoth mechanisms share the same channel, the same predictable pipe name, the same impact, and the same access preconditions.\n\n## Impact\n\nPotential arbitrary code execution inside the Visual Studio process that hosts the affected component (the UI process, the code-analysis process, or the CodeLens process), with full loss of confidentiality, integrity and availability within that process.\n\n**Mitigating factor (limits practical severity to Medium):** the pipe is created with the default Windows ACL (no explicit `PipeSecurity`), which permits **only same-user processes to write**. All of the Visual Studio processes involved run as the same logged-in developer, so exploitation requires the attacker to already be executing code as that same user. There is **no privilege escalation** and no crossing of a security boundary; the practical value is code execution inside the developer's Visual Studio session (lateral movement / persistence within an already same-user-compromised context). This is why the practical severity is **Medium** despite the CVSS base score.\n\n## Severity\n\nCVSS v3.1: `AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H` = **7.3 (High)** base score; **practical severity Medium**, because the attacker gains no privilege beyond what they already had (same user, same Visual Studio session).\n\nCVSS v4.0 cross-check: `CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` = 7.0 (High). The Subsequent-System metrics are None because no security boundary is crossed.\n\n## Affected products and remediation\n\nAll affected products are part of the Visual Studio integration.\n\n| Product | Affected | Remediation |\n|---|---|---|\n| NuGet `Metalama.Framework` | all `< 2026.1.19` | upgrade to **2026.1.19** (no backports) |\n| VS extension `PostSharpTechnologies.PostSharp` (\"Metalama + PostSharp\", maintained) | **2024.1 - 2026.1.4** | update to **2026.1.5** (bundles Metalama 2026.1.19) |\n| VS extension `PostSharpTechnologies.Metalama` (retired) | all versions | uninstall / migrate to PostSharp `>= 2026.1.5` |\n| VS extension `PostSharpTechnologies.caravela` (retired) | all versions | uninstall / migrate to PostSharp `>= 2026.1.5` |\n\nThe PostSharp extension was a separate, Metalama-free product before the 2024.1 merge (Metalama.Vsx issue #33843), so earlier PostSharp versions are not affected. GitHub has no Visual Studio Marketplace ecosystem, so only the NuGet package appears in the structured \"Affected products\" list.\n\n## Fix\n\nFixed in Metalama **2026.1.19** (commit `d97f52e1b5`, PR #1651): the type-name deserialization is wrapped in `RpcContractMessagePackOptions`, which enforces a `[RpcContract]` type allow-list on the wire; pipe access is restricted to the current user. The fix reaches the maintained Visual Studio extension in version **2026.1.5**. The retired Caravela and Metalama extensions will not be fixed.",
  "id": "GHSA-h26j-4vp7-x9w2",
  "modified": "2026-11-03T16:45:05.710760592Z",
  "published": "2026-11-03T16:37:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/security/advisories/GHSA-h26j-4vp7-x9w2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62848"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/pull/1651"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/commit/5b4ced29f2b25631cc2e44d05b0fd5fe838b6cbe"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/commit/d97f52e1b53ffe4176b2b05c56ffdf1ccd2f53a9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/metalama/Metalama"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/releases/tag/release/2025.1.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/releases/tag/release/2026.0.25"
    },
    {
      "type": "WEB",
      "url": "https://github.com/metalama/Metalama/releases/tag/release/2026.1.19"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution"
}