{"id":"CVE-2026-49484","title":"Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform","summary":"Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","cwe":["CWE-377","CWE-459"],"vendor":"codefori","product":"vscode-ibmi","affected":["vscode-ibmi < 3.0.1"],"published":"2026-10-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T16:00:33.533","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49484","references":[{"url":"https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e","label":"security-advisories@github.com"},{"url":"https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-9869-gm55-mqpq","label":"security-advisories@github.com"},{"url":"https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-9869-gm55-mqpq","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00296,"epssPercentile":0.22176,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T13:59:04.730611Z"},"cvssSource":"cna","ingestedAt":"2026-10-12T23:07:25.636Z","slug":"CVE-2026-49484","body":"## Overview\n\nCode for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":28.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":222349,"id":"CVE-2026-49484","ts":1792073297648,"field":"exploit_available","old":"false","new":"true"},{"seq":220799,"id":"CVE-2026-49484","ts":1792026793096,"field":"cvss","old":null,"new":"5.1"},{"seq":220798,"id":"CVE-2026-49484","ts":1792026793096,"field":"severity","old":"none","new":"medium"}]}