Zero Day Alert in Visual Studio Code: A single click could steal your GitHub tokens

A security researcher published exploit code for a zero-day vulnerability in Visual Studio Code that allows to steal GitHub authentication tokens with a single click on a malicious link. According to the author's public analysis, the failure abuses the web-view system and the passing of messages in VS Code to run JavaScript within a drunk view, simulate key pulsations and force the installation of a malicious extension that captures the token OAuth that github.dev receives from github.com.

Understanding the technique is key to risk assessment: github.dev performs a POST with an OAuth token which, according to the researcher, is not limited to the specific repository, but provides access to all the repositories to which the user can access. That means that an attacker who gets that token can consult the GitHub API to list and clone private repositories, pivote or extract secrets stored in code. Researcher Ammar Askar published an analysis and the proof-of-concept on his blog and on GitHub showing the chain of exploitation; the technical detail can be read in his article and in the repository with the PoC: Askar's explanation and PoC in GitHub.

From the vulnerability classification perspective, Microsoft and other suppliers consider a defect as zero-day when it is publicly disclosed or actively exploited without an official patch; Microsoft documents this criterion in its vulnerability management guide: What a zero- day is. In this case the failure had no CVE or patch at the time of publication, so the community should take immediate precautions.

For users and development teams, the practical implications are direct: a single click on a link that opens github.dev under certain conditions could result in commitment of tokens with wide access. The tokens credentials are equivalent to access keys: their exposure allows actions on behalf of the user and may affect private repositories, automated integrations and deployments that depend on such credentials.

Immediate measures that reduce the risk while there is no patch: close session on github.dev and delete cookies and local site data for github.dev in the browser, so that the extension authorization dialog appears again (this requires manual confirmation before the extension receives a token). Avoid clicking on unverified links that open VS Code or github.dev from emails, chats or websites; prefer to open repositories from GitHub's web interface directly and, if you should use github.dev, do so from an isolated browser profile.

If you suspect commitment, mediation actions should include revoking any affected personal token, creating smaller-range tokens (using "fine-grained" personal access tokens where possible) and rotating credentials used by scripts or CI / CD. Check the API activity and audit records in your account or organization to detect suspicious calls and access repositories. GitHub offers guides on how to keep accounts and tokens safe; see your documentation for specific procedures on revocation and audit.

At the organizational level, the principle of minor privilege should be applied: to replace tokens with global permits with necessary minimum permits, to use mandatory multifactor authentication (MFA), to manage access through SSO or identity providers and to audit the OAuth apps and tokens authorized in the equipment accounts. It is also recommended to segregate development environments, limit the presence of secrets in repositories and monitor integrations that can be abused if a partner is committed.

This incident also reopens the discussion on trust and responsible disclosure processes: the investigator claims that his decision to publish immediately was motivated by previous experiences with the handling of reports by official channels. The tension between public disclosure and coordination with suppliers is recurrent and has effects on collective security; however, until there is a patch, the responsibility lies with users and managers to mitigate impact.

In short, treat this event as a reminder that tokens matter as much as passwords: maintain good credentials management practices, delete session data from github.dev if you do not trust the link you will open, revoke and rotate tokens when there is suspicion and apply stricter access controls in organizations. To expand how to protect your account and manage tokens, see GitHub's official documentation on security and authentication.