What’s Vulnerable › Vulnerabilities

CVE-2026-49483: Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

• Severity: high (CVSS 8.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-16
• Weakness: CWE-345

Description

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

Affected products

• codefori vscode-ibmi: before 3.0.1

References

• https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e
• https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-rmqv-7c5v-wvjc

Get alerted when CVE-2026-49483 or the next vulnerability affects your stack