CVE-2026-49483CWE-345CWE-732

CVE-2026-49483

published October 13, 2026

CVSS
8.9
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

The record
Technical detail
CVSS
8.9 · NONE
CVSS v4.0
8.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00142 · 3.2th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-10-13T02:17Z
References (2)
https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e · [email protected]https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-rmqv-7c5v-wvjc · [email protected]
EPSS history
Timeline
  • 14 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 12 OCT 21:36Z
    Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
    cvelistv5
  • 12 OCT 21:36Z
    Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
    cvelistv5