The vulnerability exists in the Code for IBMi Visual Studio Code extension, which accepts components implementing IBMiComponent after verifying that a procedure exists without properly validating the component’s integrity. Because components with broad public permissions can be modified by another local account—changing programs such as GETMBRINFO—the extension allows an attacker to submit a tampered component and later trigger its execution, leading to arbitrary code execution on the IBM i system. This flaw permits local privilege escalation as the altered program is executed under the connecting account.

This flaw affects all installations of the codefori:vscode-ibmi extension on IBM i that run a version older than 3.0.1. The extension was released with a fix in version 3.0.1 that enforces proper integrity checks before accepting components, so newer versions are not vulnerable.

The CVSS score of 8.9 indicates a severe risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, we cannot quantify likelihood with current metrics, but the flaw is exploitable by any local account that has permission to install components, especially when the component installation directories grant public write access. Once a tampered component is installed, a user can reconnect and trigger its execution, yielding arbitrary code execution with local privileges. The attack vector is local and requires no remote exploitation capability.