VS Code zero-day lets hackers steal GitHub tokens in one click
A VS Code zero-day can be abused to steal GitHub OAuth tokens through a crafted link. The flaw is unpatched, and a proof of concept is already public.
Intelligence analysis by GPT-5.4 Mini
Security researcher Ammar Askar says a VS Code flaw can be used to run malicious JavaScript in a webview, install an extension, and pull GitHub OAuth tokens from github.dev. Those tokens can then be used to enumerate the victim's private repositories.
A broken door in VS Code can trick someone into clicking a link that sneaks in a bad add-on. That add-on can grab a special GitHub key, like finding a master key that opens several private toy boxes instead of just one.
Analysis
What happened
BleepingComputer reports that a security researcher, Ammar Askar, publicly released exploit code for a zero-day in Visual Studio Code. The flaw targets VS Code's sandboxed webview message-passing system and can be triggered through a link.
According to the article, the attack can make a victim install a malicious extension. Once that happens, the extension can steal the GitHub OAuth token that github.dev sends during sign-in. That token can then be used to query the GitHub API and enumerate private repositories the victim can access.
Why the token matters
The article says the token is not limited to the single repository the user opened. Instead, it has access to every other repository the user can reach on GitHub. That turns a single successful click into broader account exposure, especially for developers with access to multiple private projects.
Current status and mitigation
The flaw has not been patched and has not been assigned a CVE ID yet, according to the report. BleepingComputer says users can reduce exposure by clearing cookies and local site data for github.dev in their browser, which forces the GitHub Repositories extension sign-in warning to appear again when a link tries to exploit the bug.
The article also says Askar disclosed the issue publicly after giving GitHub one hour of notice, citing a prior negative experience with Microsoft's response process. Microsoft had not responded to BleepingComputer's request for comment at the time of publication.
Key points
- A VS Code zero-day can be used to steal GitHub OAuth tokens with a link click.
- The attack abuses VS Code's sandboxed webview message-passing system.
- The proof of concept can install a malicious extension and query private repositories.
- The vulnerability is unpatched and has not yet been assigned a CVE ID.
- Users can clear github.dev cookies and local site data to restore the sign-in warning.
Public disclosure and a working proof of concept may speed up fixes and defensive guidance. The article also gives a concrete browser-side workaround that can help users trigger the safer sign-in warning again.
Until a patch exists, attackers can keep abusing the flaw with a one-click lure. Because the stolen token can reach more than one private repository, the impact can extend beyond the specific project a developer opened.
