Left limbo: reviewed by GitHub after 130 days
GHSA-h26j-4vp7-x9w2
Metalama.Framework on NuGet · published in metalama/metalama
Facts
- Severity
- High · CVSS score 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Affected versions (Metalama.Framework)
- < 2026.1.19As entered by the maintainer. Not reviewed.
- Fixed in (Metalama.Framework)
- 2026.1.19
- Affected versions (PostSharpTechnologies.PostSharp)
- < 2026.1.19As entered by the maintainer. Not reviewed.
- Fixed in (PostSharpTechnologies.PostSharp)
- 2026.1.19
- Package name (PostSharpTechnologies.Metalama)
- PostSharpTechnologies.MetalamaAs entered. Cleaned up for matching.
- Affected versions (PostSharpTechnologies.Metalama)
- AllAs entered by the maintainer. Not reviewed.
- Fixed in (PostSharpTechnologies.Metalama)
- None (Upgrade to PostSharpTechnologies.PostSharp)
- Package name (PostSharpTechnologies.caravela)
- PostSharpTechnologies.caravela As entered. Cleaned up for matching.
- Affected versions (PostSharpTechnologies.caravela)
- AllAs entered by the maintainer. Not reviewed.
- Fixed in (PostSharpTechnologies.caravela)
- None (Upgrade to PostSharpTechnologies.PostSharp)
- Affected versions (Metalama.Framework)
- < 2025.1.18As entered by the maintainer. Not reviewed.
- Fixed in (Metalama.Framework)
- 2025.1.18
- Affected versions (Metalama.Framework)
- < 2026.0.25As entered by the maintainer. Not reviewed.
- Fixed in (Metalama.Framework)
- 2026.0.25
- CVE
- CVE-2026-62848 · published
- GitHub Advisory Database
- Reviewed
- OSV.dev
- Not checked
- Other CVEs pointing here
- None found in the CVE List
If you use Metalama.Framework < 2026.1.19
Upgrade to 2026.1.19 or later. It’s in GitHub’s reviewed database now, so Dependabot, npm audit and OSV-Scanner can report it.
Timeline
2026-06-27 09:47 UTC
Published by the maintainers
Cites CVE-2026-62848
2026-10-28 07:21 UTC
First seen by Limbowatch
In limbo
2026-10-31 12:52 UTC
Change recorded
CVE-2026-62848 RESERVED -> PUBLISHED
2026-11-04 14:51 UTC
Reviewed by GitHub
Left limbo after 130 days