CVE-2026-49483GHSA-rmqv-7c5v-wvjc
vscode-ibmi: Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
codefori vscode-ibmi
CVSS
8.9HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.0vscode-ibmiGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.
Text from CVE List
Affected versions 2
- vscode-ibmiaffected: < 3.0.1CVE List
- vscode-ibmi<2.18.0GitHub