CVE-2026-49484
MEDIUM 5.1Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 22nd percentile
Impact if exploited
5.1CVSS 4.0 · MEDIUM
- ConfidentialityLow
- IntegrityLow
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ⚠User interaction: Succeeds with passive user activity
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-377: : Insecure Temporary File
- CWE-459: : Incomplete Cleanup
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.1 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L - MEDIUM 5.1 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-9869-gm55-mqpq CVE record · GitHub_M · Updated 2026-10-12T21:37:50.356Z
CVE record · CISA-ADP · Updated 2026-10-15T14:00:01.442Z
NVD · CVE-2026-49484 · Updated 2026-10-16T16:00:33.533
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97970 EUVD · EUVD-2026-97970
Technical & other
- https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e CVE record · GitHub_M · Updated 2026-10-12T21:37:50.356Z
NVD · CVE-2026-49484 · Updated 2026-10-16T16:00:33.533