Reported by 1 outlet

Timeline

1. original reporting

   VS Code Zero-Day Leaks GitHub OAuth Tokens via Single Click — Public PoC Released, No Patch Available

   bleepingcomputer.com · 133d ago · June 3rd, 2026

   A critical vulnerability in Visual Studio Code's webview message-passing system allows attackers to steal full-scope GitHub OAuth tokens by tricking a victim into clicking a single link — granting read/write access to every repository the victim can access, including private ones. Security researcher Ammar Askar released a working proof-of-concept exploit on June 2, choosing full public disclosure after a prior negative experience with Microsoft's Security Response Center.

   How it works: github.dev (VS Code's browser-based editor) authenticates users by POSTing an OAuth token that is not scoped to a single repository. Malicious JavaScript embedded in a webview can simulate keypresses in the main editor to install an extension that exfiltrates the token and queries the GitHub API for every accessible repo. No fix exists — this is a true zero-day.

   Temporary mitigation: Clear cookies and local site data for github.dev in browser settings. This forces a re-authentication dialog that includes an "Extension wants to sign in" warning. Organizations should block or monitor github.dev access via CASB/proxy policies until Microsoft issues a patch.

   Broader context: This is the seventh publicly disclosed zero-day in Microsoft products in two months, following the "Nightmare Eclipse" disclosures of BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma — with three confirmed actively exploited in the wild. The researcher's stated distrust of MSRC's disclosure process mirrors the pattern driving this disclosure wave.

   ---