CVE-2026-49483 PUBLISHED

Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

Assigner: GitHub_M
Reserved: 30.05.2026 Published: 12.10.2026 Updated: 12.10.2026

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.9

Product Status

Vendor codefori
Product vscode-ibmi
Versions
  • Version < 3.0.1 is affected

References

Problem Types

  • CWE-732: Incorrect Permission Assignment for Critical Resource CWE
  • CWE-345: Insufficient Verification of Data Authenticity CWE