GTN Security Intelligence Hub

CVE-2026-62847

Reporte público de vulnerabilidad

BAJA Exploit público detectado CVSS 8.2 / HIGH CWE-377

GTN Risk Score

33/100

Monitoreo

Score calculado con CVSS, EPSS, CISA KEV, evidencia pública de exploit y vector de ataque.

Resumen ejecutivo

CVE-2026-62847 presenta una prioridad BAJA. El análisis público consolidado indica CVSS 8.2 (ALTA), EPSS 0.15%, CISA KEV: No, exploit público detectado: Sí. El GTN Risk Score es 33/100 (Monitoreo). Producto/proveedor asociado: No disponible / No disponible. Se recomienda validar exposición, revisar advisories oficiales, aplicar parche o mitigación disponible y monitorear actividad relacionada.

Resumen ejecutivo

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19. Resumen de riesgo: CVE-2026-62847 presenta CVSS 8.2, severidad ALTA, EPSS 0.15%, CISA KEV: No, exploit público detectado: Sí. Producto/proveedor asociado: No disponible / No disponible. Se recomienda validar exposición, revisar versiones afectadas, aplicar parche o mitigación disponible y monitorear actividad relacionada.

Indicadores

EPSS 0.15% / valor crudo: 0.001510000
Percentil 4.27% / valor crudo: 0.042670000
CISA KEV No
CVSS 8.2
Severidad HIGH
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector LOCAL

¿De qué se trata?

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.

Producto / proveedor

Vendor No disponible
Producto No disponible
Nombre vulnerabilidad No disponible
CWE CWE-377

Fechas

Publicada 2026-10-30T21:17:13.807
Modificada 2026-10-30T23:17:12.923
Due Date CISA No aplica
Consultada 2026-11-01 18:42:36

Estado de explotación

Estado Exploit público detectado
Exploit público Sí
Confianza Media-Alta

Evidencia encontrada

Fuente Estado Detalle Confianza
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media
NVD References Referencia sospechosa/PoC NVD contiene una referencia relacionada con PoC, exploit o repositorio público. Media

Nota: esta sección es referencial y defensiva. La ausencia de evidencia pública no garantiza que no exista explotación privada o no publicada.

¿Cómo superarlo / mitigarlo?

Referencias

Volver al inicio Nueva consulta
Portal orientado a análisis defensivo de vulnerabilidades. No ejecuta exploits ni entrega instrucciones ofensivas.