CVE-2026-49484: Code for IBM i Information Disclosure Flaw

CVE-2026-49484 Overview

CVE-2026-49484 affects Code for IBM i, a Visual Studio Code extension used to maintain and compile Integrated Language Environment (ILE) programs on the IBM i platform. The extension stores Object Browser downloads and edit-save flow content in the shared /tmp directory without reliable cleanup. On multi-user systems where /tmp is readable by other local accounts, downloaded or edited source content remains exposed after the operation completes. The flaw is tracked under [CWE-377: Insecure Temporary File] and is fixed in version 3.0.1.

Critical Impact
Local users on shared IBM i or developer systems can read sensitive source code, data file contents, and object artifacts handled through the Code for IBM i extension.

Affected Products

Code for IBM i VS Code extension prior to version 3.0.1
src/ui/views/objectBrowser.ts Object Browser download flow
Edit-save flow writing temporary content to the shared /tmp directory

Discovery Timeline

2026-10-12 - CVE-2026-49484 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-49484

Vulnerability Analysis

The Code for IBM i extension downloads remote source members and objects to the local workstation for editing within VS Code. The Object Browser download routine in src/ui/views/objectBrowser.ts writes those artifacts to the shared /tmp directory. The edit-save flow reuses the same shared location when staging content back to the IBM i host.

Temporary files persist without reliable cleanup after the operation completes. On Linux and macOS endpoints, /tmp is world-readable by default, allowing any local account to enumerate and read the staged content. The exposed material can include proprietary ILE source code (RPG, COBOL, CL), data queue extracts, and object metadata retrieved from the IBM i system.

Exploitation requires only an authenticated local shell on the developer workstation. The attacker reads files from /tmp directly; no interaction with the VS Code process or the IBM i host is needed.

Root Cause

The root cause is the use of a predictable, shared temporary directory without per-user isolation or deterministic cleanup. CWE-377 covers this class of defect, where temporary files are created in a location accessible to other local principals and are not removed when no longer needed.

Attack Vector

A local user on the same workstation enumerates /tmp and reads files written by the Code for IBM i extension. Because the files remain after download or save, the attack window extends beyond the active editing session. Multi-tenant developer servers, shared build hosts, and jump boxes used to access IBM i environments are the primary exposure.

typescript

// Patch excerpt - src/api/components/component.ts
// Source: https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e

type ComponentStatus = `NotChecked` | `NotInstalled` | `NeedsUpdate` | `Installed` | `Error`;
/** @deprecated use {@link SecureComponentState} instead */
export type ComponentState = ComponentStatus;
export type SecureComponentState = { status: ComponentStatus, remoteSignature?: string };

export type ComponentIdentification = {
  name: string
  version: number | string
  signature: string
  userManaged?: boolean
}

export type ComponentInstallState = {
  id: ComponentIdentification
  state: SecureComponentState
}

The 3.0.1 commit tightens component state handling and redirects temporary file operations away from the shared /tmp location. Review the full GitHub commit for the complete patch.

Detection Methods for CVE-2026-49484

Indicators of Compromise

Files in /tmp matching IBM i source member naming patterns (for example, .rpgle, .sqlrpgle, .clle, .cbl extensions) owned by developer accounts
Unexpected read access by non-owner local users to files created by the Code for IBM i extension
Presence of staged Object Browser downloads in /tmp that persist across VS Code sessions

Detection Strategies

Audit the installed version of the Code for IBM i extension across developer endpoints and flag versions below 3.0.1
Monitor file access events in /tmp for cross-user reads of files created by VS Code processes
Inventory multi-user systems where IBM i developers run VS Code and apply higher scrutiny to those hosts

Monitoring Recommendations

Enable file access auditing (auditd on Linux, Endpoint Security on macOS) for /tmp on shared developer hosts
Alert on local accounts reading files owned by other users within /tmp outside of system maintenance windows
Track VS Code extension inventory via endpoint management tooling to confirm patch adoption

How to Mitigate CVE-2026-49484

Immediate Actions Required

Upgrade the Code for IBM i extension to version 3.0.1 or later on every developer workstation
Clear residual Code for IBM i artifacts from /tmp on affected systems
Restrict shell access on multi-user developer hosts to limit cross-account exposure

Patch Information

The fix ships in Code for IBM i version 3.0.1. See the GitHub Security Advisory GHSA-9869-gm55-mqpq and the upstream commit for the full change set.

Workarounds

Set restrictive permissions on /tmp (for example, enforce the sticky bit and remove world-read where feasible) on shared developer hosts
Point the extension and VS Code at a per-user temporary directory via the TMPDIR environment variable before launching VS Code
Avoid using the Code for IBM i Object Browser download and edit-save features on multi-tenant systems until all users are patched

bash

# Configuration example - redirect temp files to a private, mode-700 directory
mkdir -p "$HOME/.cache/vscode-ibmi-tmp"
chmod 700 "$HOME/.cache/vscode-ibmi-tmp"
export TMPDIR="$HOME/.cache/vscode-ibmi-tmp"
code .