Code Execution Vulnerability in IBMi Visual Studio Code Extension by Code for IBMi
CVE-2026-49483

8.9HIGH

Key Information:

Vendor

Codefori

Status
Vscode-IBMi
Vendor
CVE Published:
12 October 2026

What is CVE-2026-49483?

The IBMi Visual Studio Code extension, designed for maintaining ILE languages on the IBMi platform, had a critical flaw before version 3.0.1. This vulnerability allowed components implementing IBMiComponent to be accepted without proper verification of their integrity. As a result, components with broadly set public permissions could be modified by local accounts, leading to unauthorized execution of altered programs. This glaring security weakness underscores the necessity of ensuring component integrity beyond simple checks, such as the LONG_COMMENT marker, which proved insufficient. The issue was addressed and resolved in the release of version 3.0.1.

Affected Version(s)

vscode-ibmi < 3.0.1

References

https://github.com/codefori/vscode-ibmi/security/advisori...
x_refsource_CONFIRM
https://github.com/codefori/vscode-ibmi/commit/6a13990a0f...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.