Piece of news of the day
ADVANCED SECURITY EUROPA
EOODUncovering the VS Code Zero-Day: How Attackers can Steal GitHub Tokens with a Click
03 June 2026A security researcher has unveiled a zero-day vulnerability in Visual Studio Code that allows attackers to steal GitHub authentication tokens by manipulating users into clicking a malicious link.
By exploiting VS Code's webview system, attackers can install harmful extensions to access GitHub OAuth tokens sent to github.dev.
This flaw has not been patched yet, but users can safeguard themselves by clearing cookies and local site data for github.dev.
The researcher chose to disclose the bug publicly due to negative past experiences with Microsoft's security response process.
This disclosure follows a series of zero-day vulnerabilities in Microsoft products shared by another researcher who criticized Microsoft's handling of the disclosure process.
No immediate response was available from Microsoft regarding this latest zero-day exploit.
