CVE-2026-49484

Received Received - Intake

IBM i VS Code Extension Temporary File Exposure

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-49484

Affected Vendors & Products

Vendor	Product	Version / Range
codefori	vscode-ibmi	< 3.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

The vulnerability in IBM i Visual Studio Code extension before 3.0.1 involves storing Object Browser downloads and edit-save content in the shared /tmp directory without proper cleanup. This allows other local users to access sensitive data after operations.

Detection Guidance

Check if the IBM i extension for VS Code version is below 3.0.1 by inspecting the installed extensions in VS Code. Look for files in the /tmp directory that may contain sensitive data from Object Browser downloads or edit-save operations. Verify if /tmp is accessible to other local accounts on the system.

Impact Analysis

If you use the vulnerable extension, other local users on the same system could read files you downloaded or edited through the Object Browser, potentially exposing sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements if patient or personal data is exposed.

Mitigation Strategies

Upgrade the IBM i extension for VS Code to version 3.0.1 or later to address the issue. Ensure the /tmp directory is not accessible to unauthorized local accounts. Regularly clean up temporary files and monitor for any suspicious access to the /tmp directory.

Hi! I’m here to help you understand CVE-2026-49484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70