Skip to content
OpenAdvisories
High · 8.9 CVE-2026-49483 EUVD-2026-97969

Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

Published Oct 12, 2026 · Updated Oct 13, 2026 · Assigned by GitHub_M

Description

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

Affected products

VendorProductAffectedFixed
codefori vscode-ibmi < 3.0.1 —

References