Code for IBM i: Missing integrity check of IBM i components allows code execution
Summary
The Visual Studio Code extension Code for IBM i (vscode-ibmi) accepts IBM i components after checking only that a procedure exists, without verifying their integrity. A local account on the IBM i host with write access to a component installed with broad public permissions, such as GETMBRINFO, can alter it. When a developer later connects, the extension runs the altered program under the developer's account, which may have higher privileges. The CVSS 4.0 vector suggests network reachability, but the description points to a local attacker, so the real exposure should be verified.
Affected
- codefori vscode-ibmi versions before 3.0.1 (CVE record and research notes)
- Note: the GHSA page excerpt lists affected versions below 2.18.0 with patched version 3.0.0, which conflicts with the CVE record; verify the final range at the GHSA page or NVD
Fixed in
- Fixed in version 3.0.1 (fix commit 6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e)
- No IBM i-side PTF identified for this issue
Workaround
Unknown.
- No vendor-documented workaround found
- Until 3.0.1 is deployed: restrict write access to IBM i components and programs loaded by the extension and review object authorities on shared libraries (hardening measure, not vendor-confirmed)
Exploitation
- Not marked as known exploited in the sources checked
- CISA SSVC: exploitation none, not automatable, total technical impact
- No public proof of concept found; absence of evidence is not confirmation
Our recommendation
- Inventory vscode-ibmi versions on all developer workstations and update every installation below 3.0.1
- Audit public or broad authorities on IBM i libraries that hold components used by the extension and remove unnecessary write access
- Review the NVD entry and the GHSA page for final affected ranges and any change in exploitation status
- Priority is high for SMEs with IBM i development teams and loose object authorities; lower where permissions are tight
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 6a13990 (codefori/vscode-ibmi) github.com
- GitHub Security Advisory GHSA-rmqv-7c5v-wvjc github.com
- OSV entry CVE-2026-49483 osv.dev
- codefori/vscode-ibmi repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:33.
Original description (NVD)
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.