Remote Code Execution Vulnerability in Metalama Toolkit for Visual Studio

CVE-2026-62848

What is CVE-2026-62848?

The Metalama toolkit for Visual Studio has been found with a vulnerability that allows local processes to send crafted messages via deserialization of named-pipe communications. This issue arises from the inadequate restriction of CLR types during the deserialization process, affecting releases from 2023.0.101-rc through specific versions in 2026. This allows for potential arbitrary code execution within the Visual Studio environment, mainly impacting the confidentiality, integrity, and availability of systems where the toolkit is deployed. Although the vulnerability does not escalate privileges across user security boundaries, it poses significant risks to data security. Remediation requires upgrading to the secured versions or removing affected extensions.

References