Vulnerabilities · 102 days ago
A browser-based VS Code session can hand an attacker far more than the page or repo the user opened. The weak point is the trust link between github.com and github.dev: a crafted webview can trigger extension install flows and steal the GitHub OAuth token that github.dev receives, which then works across every repo the user can reach.
The public proof-of-concept shows malicious JavaScript running inside a webview, simulating editor clicks to install an extension, then extracting the token and using GitHub’s API to list private repositories. Microsoft has not patched it and no CVE has been assigned; the token is not scoped to a single repo, so revoking interest in one project does not contain the exposure.
For teams using browser-based IDEs or other embedded apps that accept OAuth tokens, the practical break is that one consent path can open an account-wide GitHub view. The risk sits in the handoff itself, not in password theft.
5 sources covering this story
The Record from Recorded Future
Researcher publishes GitHub token-stealing exploit, blames Microsoft’s disclosure process
The security researcher, Ammar Askar, released the new proof-of-concept exploit on his personal blog — alongside the public tracker for issues in VS Code — giving a GitHub security contact roughly one hour's notice beforehand.
VS Code Vulnerability Allows One-Click GitHub Token Theft
A researcher has disclosed the full details of the vulnerability and released a PoC without notifying Microsoft in advance.
Microsoft Fixes One-Click GitHub Dev Attack That Let Attackers Steal OAuth Tokens
VS Code flaw exposes GitHub OAuth tokens via one-click attack on GitHub.dev, enabling private repo access and token theft.
Hole in GitHub’s browser-based VSCode editor could lead to stolen token
Its disclosure raises questions about what security researchers should expect from vendors, and how far in advance of its publication they should notify vendors about a bug.
VS Code zero-day lets hackers steal GitHub tokens in one click
A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link.
Part of the PlainSec briefing for 2026-06-03