{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/metalama.framework--2026.1.19/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postsharp:metalama.framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-62848"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Metalama.Framework (\u003c 2026.1.19)","PostSharpTechnologies.PostSharp (2024.1 - 2026.1.4)","PostSharpTechnologies.Metalama (all versions)","PostSharpTechnologies.caravela (all versions)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostSharp"],"content_html":"\u003cp\u003eMetalama's Visual Studio integration utilizes inter-process communication (IPC) via local Windows named pipes to exchange data between the Visual Studio UI process (\u003ccode\u003edevenv\u003c/code\u003e), Roslyn analysis processes, and CodeLens. These pipes perform unsafe deserialization of incoming messages without an allow-list, enabling arbitrary .NET type instantiation.\u003c/p\u003e\n\u003cp\u003eThe vulnerability manifests through two primary deserialization mechanisms:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eNewtonsoft.Json with \u003ccode\u003eTypeNameHandling.All\u003c/code\u003e (Metalama 2023.0 through 2026.0.x).\u003c/li\u003e\n\u003cli\u003eTypeless MessagePack (Metalama 2026.1.0 through 2026.1.18).\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eBoth mechanisms leverage predictable pipe names (\u003ccode\u003eMetalama_{role}_{processId}_{hash(PackageVersion)}\u003c/code\u003e). Because the pipe access is restricted to the same logged-in user via default Windows ACLs, successful exploitation allows an attacker already executing code under the developer's context to achieve code execution within the Visual Studio process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution within the Visual Studio UI, Roslyn analysis, or CodeLens processes. This grants the attacker full control over the process context, including the ability to access data and modify developer environment states, limited to the permissions of the current logged-in user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eMetalama.Framework\u003c/code\u003e to version 2026.1.19 or later.\u003c/li\u003e\n\u003cli\u003eUpdate the \u003ccode\u003ePostSharpTechnologies.PostSharp\u003c/code\u003e Visual Studio extension to version 2026.1.5 or later.\u003c/li\u003e\n\u003cli\u003eUninstall retired extensions \u003ccode\u003ePostSharpTechnologies.Metalama\u003c/code\u003e and \u003ccode\u003ePostSharpTechnologies.caravela\u003c/code\u003e and migrate to the maintained PostSharp extension (\u0026gt;= 2026.1.5).\u003c/li\u003e\n\u003cli\u003ePrioritize these updates for developer workstations where the Metalama extension is active.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T04:13:40Z","date_published":"2026-11-04T04:13:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-metalama-deserialization/","summary":"Metalama's Visual Studio integration is vulnerable to arbitrary code execution due to unsafe deserialization of inter-process communication messages via predictable named pipes, requiring local access as the same user.","title":"PostSharp Metalama: Unsafe deserialization in Visual Studio named pipes (CVE-2026-62848)","url":"https://feed.craftedsignal.io/briefs/2026-11-metalama-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Metalama.Framework (\u003c 2026.1.19)","version":"https://jsonfeed.org/version/1.1"}