CVE-2026-49484 in Vscode-Ibmi
Summary
by MITRE • 10/13/2026
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Code for IBM i versions prior to 3.0.1 represents a significant information disclosure risk stemming from improper handling of temporary files within the operating system's shared resource space. The extension, which facilitates the maintenance and compilation of ILE languages on the IBMi platform via Visual Studio Code, utilizes the /tmp directory as a staging area for various operations. Specifically, during activities such as downloading objects through the Object Browser or executing edit-save workflows, sensitive data is written to this location without implementing robust cleanup mechanisms after the operation completes. This architectural decision creates a window of exposure where transient files containing potentially confidential source code, configuration details, or other proprietary information remain on disk long enough for unauthorized access.
The core technical flaw lies in the lack of reliable file deletion and the use of a world-writable directory that is accessible to all local user accounts on many IBMi system configurations. In Unix-like environments, including those underlying IBM i OS, /tmp is typically configured with permissions allowing any authenticated user to read, write, or execute files within it unless specific restrictions are applied by the system administrator. When Code for IBM i writes data to this directory and fails to securely erase these temporary artifacts immediately after use, subsequent local users can enumerate the directory contents and retrieve the residual files. This persistence of sensitive data in a shared namespace effectively bypasses standard access controls intended to isolate user-specific workspaces, leading to an unintended leakage of information that was never meant to be public or accessible beyond the initiating process context.
From an operational impact perspective, this vulnerability allows for local privilege escalation through information gathering rather than direct code execution. An attacker with a low-privileged account on the same IBMi system can scan the /tmp directory for recently created files associated with Code for IBM i processes. By reading these leftover files, the attacker may extract proprietary source code snippets, internal application logic, database connection strings, or other sensitive metadata that could aid in further attacks against the organization's infrastructure. This scenario aligns closely with CWE-377, which describes insecure temporary file creation, and specifically highlights the risks associated with predictable filenames and insufficient cleanup procedures in shared directories. The impact is particularly severe in multi-user development environments where multiple developers or automated build systems share access to the same host system without strict isolation policies.
To mitigate this vulnerability, organizations must ensure they upgrade Code for IBM i to version 3.0.1 or later, which addresses these file handling deficiencies by implementing proper cleanup routines and potentially utilizing more secure temporary storage mechanisms that are not globally readable. In addition to updating the software extension, system administrators should review their /tmp directory permissions and consider mounting it with noexec, nosuid, and nodev options if applicable, although on IBMi this may require specific configuration changes depending on the OS version. Furthermore, implementing strict access control lists (ACLs) or using dedicated temporary directories for each user session can prevent cross-user data leakage. Security teams should also monitor for unusual file creation patterns in shared directories as part of their endpoint detection and response strategies to identify potential exploitation attempts where attackers attempt to harvest sensitive artifacts from poorly managed temporary storage locations. This incident underscores the importance of adhering to secure coding practices that prioritize ephemeral data isolation, ensuring that transient information is destroyed immediately after use rather than left exposed in accessible system spaces.