Code Storage Vulnerability in IBM i Extension for Visual Studio Code
CVE-2026-49484

5.1MEDIUM

Key Information:

Vendor

Codefori

Status
Vscode-IBMi
Vendor
CVE Published:
12 October 2026

What is CVE-2026-49484?

The Code for IBM i extension for Visual Studio Code, prior to version 3.0.1, contains a vulnerability where the Object Browser downloads and edit-save flow contents are stored in the shared /tmp directory. This setup lacks reliable cleanup, leading to potential exposure of sensitive files. If the /tmp directory is accessible to other local accounts, unauthorized users may read file contents following download or editing. This issue underscores the importance of proper file permission management in safeguarding user data, and it has been resolved in the latest version.

Affected Version(s)

vscode-ibmi < 3.0.1

References

https://github.com/codefori/vscode-ibmi/security/advisori...
x_refsource_CONFIRM
https://github.com/codefori/vscode-ibmi/commit/6a13990a0f...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.