{"id":"GHSA-h26j-4vp7-x9w2","summary":"Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution","details":"## Summary\n\nMetalama uses a local named-pipe channel to communicate between its Visual Studio processes — the Visual Studio UI process (`devenv`), the out-of-process Roslyn code-analysis process, and the CodeLens process. This channel deserialized messages from the pipe **without restricting which CLR types could be instantiated**. A local process able to write to the pipe can send a crafted message that instantiates arbitrary .NET types — a deserialization primitive in the same class as `BinaryFormatter` (CWE-502), and a well-known gadget-chain code-execution vector.\n\nThe flaw is present, via two successive serializers, in **every Metalama release from the first public version (2023.0) up to and including 2026.1.18**, and is fixed in **2026.1.19**.\n\nThe pipe name is predictable: `Metalama_{role}_{processId}_{hash(PackageVersion)}`, derived from the public package version and a locally-enumerable process id. This channel is used by the Visual Studio integration only (Windows named pipes); it is not used for command-line / MSBuild builds.\n\n## Mechanisms\n\n**JSON era — Metalama 2023.0 through 2026.0.x (Newtonsoft.Json).** The pipe formatter enabled polymorphic type embedding:\n```csharp\nformatter.JsonSerializer.TypeNameHandling = TypeNameHandling.All;   // ServiceEndpoint.cs (early), later BaseEndpoint.cs\n```\nThe accompanying `SerializationBinder` (added later for multi-version assembly support) only **remapped assembly names**; its `BindToType` resolved **any** type name from the wire (`assembly.GetType(typeName)`) with **no type allow-list**. `TypeNameHandling.All` is the canonical unsafe-deserialization setting and has publicly available gadget chains (e.g. ysoserial.net), so this era is at least as exploitable as the later one. (Introduced by commit `0554368737`, first shipped in `release/2023.0.101-rc`.)\n\n**MessagePack era — Metalama 2026.1.0 through 2026.1.18.** The 2026.1 line migrated the pipe serialization to MessagePack (PR #1299, commit `117b607805`, 2026-01-29), using **typeless** MessagePack (`TypelessObjectResolver`), which likewise embeds CLR type names on the wire and instantiates arbitrary types on receipt — again with no allow-list.\n\nBoth mechanisms share the same channel, the same predictable pipe name, the same impact, and the same access preconditions.\n\n## Impact\n\nPotential arbitrary code execution inside the Visual Studio process that hosts the affected component (the UI process, the code-analysis process, or the CodeLens process), with full loss of confidentiality, integrity and availability within that process.\n\n**Mitigating factor (limits practical severity to Medium):** the pipe is created with the default Windows ACL (no explicit `PipeSecurity`), which permits **only same-user processes to write**. All of the Visual Studio processes involved run as the same logged-in developer, so exploitation requires the attacker to already be executing code as that same user. There is **no privilege escalation** and no crossing of a security boundary; the practical value is code execution inside the developer's Visual Studio session (lateral movement / persistence within an already same-user-compromised context). This is why the practical severity is **Medium** despite the CVSS base score.\n\n## Severity\n\nCVSS v3.1: `AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H` = **7.3 (High)** base score; **practical severity Medium**, because the attacker gains no privilege beyond what they already had (same user, same Visual Studio session).\n\nCVSS v4.0 cross-check: `CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` = 7.0 (High). The Subsequent-System metrics are None because no security boundary is crossed.\n\n## Affected products and remediation\n\nAll affected products are part of the Visual Studio integration.\n\n| Product | Affected | Remediation |\n|---|---|---|\n| NuGet `Metalama.Framework` | all `\u003c 2026.1.19` | upgrade to **2026.1.19** (no backports) |\n| VS extension `PostSharpTechnologies.PostSharp` (\"Metalama + PostSharp\", maintained) | **2024.1 - 2026.1.4** | update to **2026.1.5** (bundles Metalama 2026.1.19) |\n| VS extension `PostSharpTechnologies.Metalama` (retired) | all versions | uninstall / migrate to PostSharp `\u003e= 2026.1.5` |\n| VS extension `PostSharpTechnologies.caravela` (retired) | all versions | uninstall / migrate to PostSharp `\u003e= 2026.1.5` |\n\nThe PostSharp extension was a separate, Metalama-free product before the 2024.1 merge (Metalama.Vsx issue #33843), so earlier PostSharp versions are not affected. GitHub has no Visual Studio Marketplace ecosystem, so only the NuGet package appears in the structured \"Affected products\" list.\n\n## Fix\n\nFixed in Metalama **2026.1.19** (commit `d97f52e1b5`, PR #1651): the type-name deserialization is wrapped in `RpcContractMessagePackOptions`, which enforces a `[RpcContract]` type allow-list on the wire; pipe access is restricted to the current user. The fix reaches the maintained Visual Studio extension in version **2026.1.5**. The retired Caravela and Metalama extensions will not be fixed.","aliases":["CVE-2026-62848"],"modified":"2026-11-03T16:45:05.710760592Z","published":"2026-11-03T16:37:44Z","database_specific":{"github_reviewed_at":"2026-11-03T16:37:44Z","nvd_published_at":"2026-10-30T21:17:13Z","cwe_ids":["CWE-502","CWE-913"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/metalama/Metalama/security/advisories/GHSA-h26j-4vp7-x9w2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62848"},{"type":"WEB","url":"https://github.com/metalama/Metalama/pull/1651"},{"type":"WEB","url":"https://github.com/metalama/Metalama/commit/5b4ced29f2b25631cc2e44d05b0fd5fe838b6cbe"},{"type":"WEB","url":"https://github.com/metalama/Metalama/commit/d97f52e1b53ffe4176b2b05c56ffdf1ccd2f53a9"},{"type":"PACKAGE","url":"https://github.com/metalama/Metalama"},{"type":"WEB","url":"https://github.com/metalama/Metalama/releases/tag/release/2025.1.18"},{"type":"WEB","url":"https://github.com/metalama/Metalama/releases/tag/release/2026.0.25"},{"type":"WEB","url":"https://github.com/metalama/Metalama/releases/tag/release/2026.1.19"}],"affected":[{"package":{"name":"Metalama.Framework","ecosystem":"NuGet","purl":"pkg:nuget/Metalama.Framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2026.1.0-preview"},{"fixed":"2026.1.19"}]}],"versions":["2026.1.0-preview","2026.1.1-preview","2026.1.10-preview","2026.1.11-preview","2026.1.12-preview","2026.1.13-preview","2026.1.14-rc","2026.1.15-rc","2026.1.16","2026.1.17","2026.1.18","2026.1.2-preview","2026.1.3-preview","2026.1.4-preview","2026.1.5-preview","2026.1.6-preview","2026.1.7-preview","2026.1.8-preview","2026.1.9-preview"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json"}},{"package":{"name":"Metalama.Framework","ecosystem":"NuGet","purl":"pkg:nuget/Metalama.Framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.1.18"}]}],"versions":["0.5.0-preview","0.5.1-preview","0.5.10-preview","0.5.11-preview","0.5.12-preview","0.5.13-preview","0.5.15-preview","0.5.16-preview","0.5.17-preview","0.5.18-preview","0.5.19-preview","0.5.2-preview","0.5.20-preview","0.5.21-preview","0.5.22-preview","0.5.23-preview","0.5.24-preview","0.5.25-preview","0.5.26-preview","0.5.27-preview","0.5.28-preview","0.5.29-preview","0.5.3-preview","0.5.30-preview","0.5.31-preview","0.5.32-preview","0.5.33-preview","0.5.34-preview","0.5.35-preview","0.5.36-preview","0.5.37-preview","0.5.38-preview","0.5.39-preview","0.5.4-preview","0.5.40-preview","0.5.41-preview","0.5.42-preview","0.5.43-preview","0.5.44-preview","0.5.45-preview","0.5.46-preview","0.5.47-preview","0.5.48-preview","0.5.49-preview","0.5.5-preview","0.5.50-preview","0.5.51-preview","0.5.52-preview","0.5.53-preview","0.5.54-preview","0.5.55-preview","0.5.56-preview","0.5.57-preview","0.5.58-preview","0.5.59-preview","0.5.6-preview","0.5.60-preview","0.5.61-preview","0.5.62-preview","0.5.63-preview","0.5.64-preview","0.5.65-preview","0.5.66-preview","0.5.67-preview","0.5.68-preview","0.5.69-preview","0.5.7-preview","0.5.70-preview","0.5.71-preview","0.5.72-preview","0.5.73-preview","0.5.74-preview","0.5.75-preview","0.5.76-preview","0.5.77-preview","0.5.78-preview","0.5.79-preview","0.5.8-preview","0.5.80-preview","0.5.81-preview","0.5.82-preview","0.5.83-preview","0.5.9-preview","2023.0.101-rc","2023.0.102-rc","2023.0.103-rc","2023.0.104-rc","2023.0.105-rc","2023.0.106-rc","2023.0.107-rc","2023.0.108-rc","2023.0.109-rc","2023.0.110-rc","2023.0.111-rc","2023.0.112-rc","2023.0.113-rc","2023.0.114","2023.0.115","2023.0.116","2023.0.117","2023.0.118","2023.0.119","2023.0.120","2023.0.121","2023.1.1-preview","2023.1.10","2023.1.11","2023.1.12","2023.1.2-preview","2023.1.3-preview","2023.1.4-preview","2023.1.5-preview","2023.1.6-rc","2023.1.7-rc","2023.1.8-rc","2023.1.9","2023.2.1-preview","2023.2.2-rc","2023.2.3-rc","2023.2.4","2023.2.5","2023.3.1-preview","2023.3.10","2023.3.2-preview","2023.3.3-preview","2023.3.4-preview","2023.3.5-rc","2023.3.6-rc","2023.3.7-rc","2023.3.8","2023.3.9","2023.4.1-preview","2023.4.2-preview","2023.4.3-preview","2023.4.4-preview","2023.4.5-rc","2023.4.6","2023.4.7","2023.4.8","2023.4.9","2024.0.1-preview","2024.0.10","2024.0.11","2024.0.12","2024.0.13","2024.0.14","2024.0.15","2024.0.16","2024.0.2-preview","2024.0.3-preview","2024.0.4-rc","2024.0.5-rc","2024.0.6","2024.0.7","2024.0.8","2024.0.9","2024.1.1-preview","2024.1.10-rc","2024.1.11-rc","2024.1.12","2024.1.13","2024.1.14","2024.1.15","2024.1.16","2024.1.17","2024.1.18","2024.1.19","2024.1.2-preview","2024.1.20","2024.1.21","2024.1.22","2024.1.23","2024.1.24","2024.1.25","2024.1.26","2024.1.27","2024.1.28","2024.1.29","2024.1.3-preview","2024.1.30","2024.1.4-preview","2024.1.5-preview","2024.1.6-preview","2024.1.7-preview","2024.1.8-preview","2024.1.9-rc","2024.2.1-preview","2024.2.10-preview","2024.2.11-preview","2024.2.12-preview","2024.2.13-rc","2024.2.14-rc","2024.2.15-rc","2024.2.16-rc","2024.2.17-rc","2024.2.18","2024.2.19","2024.2.2-preview","2024.2.20","2024.2.21","2024.2.22","2024.2.23","2024.2.24","2024.2.25","2024.2.26","2024.2.27","2024.2.28","2024.2.29","2024.2.3-preview","2024.2.30","2024.2.31","2024.2.32","2024.2.4-preview","2024.2.5-preview","2024.2.6-preview","2024.2.7-preview","2024.2.8-preview","2024.2.9-preview","2025.0.1-preview","2025.0.10","2025.0.11","2025.0.12","2025.0.2-preview","2025.0.3-preview","2025.0.4-preview","2025.0.5-preview","2025.0.6-rc","2025.0.7-rc","2025.0.8","2025.0.9","2025.1.1-preview","2025.1.10","2025.1.11","2025.1.12","2025.1.13","2025.1.14","2025.1.15","2025.1.16","2025.1.17","2025.1.2-preview","2025.1.3-rc","2025.1.4-rc","2025.1.5","2025.1.6","2025.1.7","2025.1.8","2025.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json"}},{"package":{"name":"Metalama.Framework","ecosystem":"NuGet","purl":"pkg:nuget/Metalama.Framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2026.0.1-preview"},{"fixed":"2026.0.25"}]}],"versions":["2026.0.1-preview","2026.0.10-rc","2026.0.11","2026.0.12","2026.0.13","2026.0.14","2026.0.15","2026.0.16","2026.0.17","2026.0.18","2026.0.19","2026.0.2-preview","2026.0.20","2026.0.21","2026.0.22","2026.0.23","2026.0.24","2026.0.3-preview","2026.0.4-preview","2026.0.5-preview","2026.0.6-rc","2026.0.7-rc","2026.0.8-rc","2026.0.9-rc"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}