CVE-2026-49484

5.1Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Passive
Impact: Limited impact
Weakness: CWE-377, CWE-459

Impact

Local users on shared systems can read downloaded and edited source code files left behind in the shared temporary directory. An attacker needs local account access to the host where the VS Code extension runs.

Root cause

The extension writes downloaded objects and edit-save files into the shared /tmp directory without setting restricted permissions or reliably cleaning them up.

Affected systems

Code for IBM i (VS Code extension) prior to 3.0.1

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Update the Code for IBM i extension to version 3.0.1 or later. If patching immediately is not possible, avoid using the extension on shared multi-user machines where /tmp is readable by other accounts.

shell

$ code --install-extension halcyon-tech.code-for-ibmi@3.0.1

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-49484