Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures
A researcher published a VS Code exploit about an hour after reporting it, citing frustration with Microsoft’s handling of security disclosures.
Intelligence analysis by GPT-5.4 Mini
Ammar Askar publicly dropped a proof of concept for a VS Code flaw tied to github.dev and Workspace Recommendations. He said past interactions with Microsoft’s security response team pushed him to bypass normal responsible disclosure.
A researcher found a bad trick in the browser version of VS Code that could let a thief steal a special login key. That key could open more of a person’s GitHub folders, like finding one house key that opens the whole building.
Analysis
What happened
Security researcher Ammar Askar published a proof of concept for a Visual Studio Code issue shortly after disclosing it to a GitHub contact. He said he chose public release because of prior bad experiences with Microsoft’s security response process.
How the bug works
The issue affects people using github.dev, the browser-based VS Code experience. According to the article, an attacker can prepare a repository so that VS Code’s Workspace Recommendations feature pushes a malicious extension. If the target opens the attacker’s repo through a crafted github.dev link, a Jupyter Notebook file loads first inside a webview. The hidden HTML in a Markdown cell then runs attacker-controlled JavaScript, which triggers a keyboard shortcut and helps auto-accept the extension prompt.
Once the malicious extension runs, it can steal the OAuth token used by github.dev. Askar said that token is not limited to the original repository, so it can be used to read and write other public or private GitHub repos the victim can access.
Why the disclosure matters
Askar said Microsoft Security Response Center had previously fixed a VS Code bug without giving credit and had treated it as lacking security impact. He framed full public disclosure as a lever to pressure Microsoft and improve VS Code’s security posture. The article links this behavior to another researcher, Nightmare Eclipse, who has also been publishing Microsoft zero-days without advance notice.
Key points
- Ammar Askar published a VS Code proof of concept roughly an hour after reporting it to GitHub.
- The flaw involves `github.dev`, Workspace Recommendations, and a malicious extension path.
- The attack can steal OAuth tokens that may unlock other public or private GitHub repositories.
- Askar said frustration with Microsoft Security Response Center influenced his decision to leak the exploit publicly.
- The story echoes another researcher, Nightmare Eclipse, who has been leaking Microsoft zero-days.
Public release could push Microsoft to treat VS Code reports more seriously and respond faster. If the company tightens `github.dev` token handling and extension prompts, the attack path described here could be shut down for users.
If the flaw is widely understood before a fix lands, attackers could try to steal OAuth tokens from victims who open crafted repositories. The article also suggests more researchers may follow the same public-leak approach if they feel ignored, leaving vendors with less time to patch.
