CVE-2026-62847 — Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

On Linux and macOS, Metalama loaded and executed compile-time assemblies, auxiliary tools, and embedded helper assemblies from predictable world-writable temporary directories. A local unprivileged user could plant a malicious DLL that was later executed in the process of a higher-privileged build user.