Code for IBM i is a Visual Studio Code extension that allows maintenance and compilation of ILE languages on the IBMi platform. Prior to version 3.0.1, the extension stored Object Browser download files and the content used in the edit‑save flow in the system’s shared /tmp directory, but it did not reliably clean up those files after use. As a result, any user with local account access to /tmp could read the contents of those temporary files, potentially revealing sensitive source code or compiled artifacts.

The vulnerability affects the Code for IBM i extension for Visual Studio Code, version 3.0.0 and earlier. The affected vendor is Code for IBM i, and the product is the vscode‑ibmi extension; fixes are released in version 3.0.1.

The CVSS score of 5.1 indicates moderate severity. The attack vector is local: any user who can access the shared /tmp directory on the same machine could read the exposed temporary files. The EPSS score is not available, so the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Given that improper file permissions are required, the risk is limited to systems where /tmp is world‑readable or configured with weak permissions, but it remains a valid information‑disclosure risk for affected environments.