Metalama Framework and Metalama Tool read compile‑time assemblies, auxiliary executable tools, and helper DLLs from predictable temporary directories. On Linux and macOS the default Path.GetTempPath() yields a world‑writable directory; Metalama trusts artifacts that contain a sentinel or ".completed" marker without performing integrity checks. The weakness is an insecure temporary file handling flaw (CWE‑377) coupled with an uncontrolled directory traversal or path selection vulnerability (CWE‑427). A local unprivileged user can pre‑create the deterministic directory structure and plant a malicious DLL with the matching sentinel file. When a higher‑privileged developer or build account triggers a build, Metalama skips regeneration and launches the planted DLL within the compiler, IDE or MSBuild process as the building user, enabling cross‑user privilege escalation, source code and secret disclosure, supply‑chain tampering, or build disruptions.

Affected versions are Metalama Framework and Metalama Tool released before 2025.1.18, 2026.0.25 and 2026.1.19. The vulnerability manifests only on Linux or macOS systems where the default temporary directory is world‑writable; Windows per‑user temp directories are protected by ACLs and are not impacted. Deployer‑selected insecure cache locations are outside the risk scope.

The CVSS score of 8.2 denotes high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The attack vector is local: an unprivileged user on a shared machine or CI environment can plant a DLL in the predictable temp path, and a subsequent privileged build process will execute it. This presents a clear opportunity for privilege escalation and supply‑chain tampering.