20260603-bleepingcomputer.com-ce624

< Back to index

VS Code zero-day lets hackers steal GitHub tokens in one click

Published:

3 June 2026 at 06:50:30

Alert date:

3 June 2026 at 07:01:00

Source:

bleepingcomputer.com

Zero-Day Vulnerabilities, Web Technologies, Enterprise Applications

A security researcher disclosed a zero-day vulnerability in Visual Studio Code that allows attackers to steal GitHub authentication tokens through a one-click exploit. The vulnerability enables token theft by tricking users into clicking a malicious link. Exploit code has been publicly released for this critical security flaw affecting VS Code users who have GitHub integration enabled. This represents a significant supply chain risk as VS Code is widely used by developers worldwide.

Technical details

A zero-day vulnerability in Visual Studio Code allows attackers to steal GitHub OAuth tokens by exploiting VS Code's sandboxed webview message-passing system. The exploit installs malicious extensions that steal GitHub OAuth tokens when passed to github.dev by running malicious JavaScript inside a webview to simulate keypresses in the main editor. The vulnerability abuses the system where github.com POSTs OAuth tokens to github.dev, and these tokens have full access to all repositories the victim can access, not just the specific repository being accessed.

Mitigation steps:

Clear cookies and local site data for github.dev in browser by clicking the Settings icon in the URL bar, then going to Cookies and site data > Manage on-device site data. This will ensure users get a warning dialog 'The extension GitHub Repositories wants to sign in using GitHub' when clicking on potentially malicious links.

Affected products:

Visual Studio Code
github.dev
GitHub OAuth tokens