A newly disclosed Visual Studio Code flaw can let attackers steal a victim’s GitHub sign-in token with a single click on a malicious link, potentially exposing all private repositories that account can access. Researcher Ammar Askar published proof-of-concept exploit code on June 3, 2026; no CVE has been assigned and no official patch is available. The bug abuses message passing between sandboxed webviews and the main editor in github.dev, allowing a malicious extension to be installed and extract a broad GitHub OAuth token.
BrianKrebs
2026.06.09
53% relevant
Krebs notes Microsoft also patched a zero-day in Visual Studio Code that can steal GitHub tokens, which appears to be the same underlying VS Code/github.dev token-theft flaw tracked separately.
2026.06.04
95% relevant
This article is a direct update on that same VS Code/github.dev token-theft zero-day, adding that researcher Ammar Askar publicly released a working exploit, said he bypassed Microsoft’s reporting process, and that GitHub received about one hour’s notice before disclosure while Microsoft has not clarified crediting, CVE assignment, or exposure scope.
Eduard Kovacs
2026.06.04
99% relevant
This article covers the same underlying event: Ammar Askar’s public disclosure of a one-click VS Code/github.dev zero-day that steals GitHub tokens via a malicious Jupyter notebook and extension install. It adds that Microsoft patched github.dev on June 3, notes the desktop VS Code path appears to remain unpatched, and reiterates the remote-code-execution risk on desktop.
2026.06.03
97% relevant
This article is a direct report on the same underlying event: Ammar Askar's public disclosure of a VS Code/github.dev flaw that abuses Workspace Recommendations and a Jupyter Notebook Webview trick to auto-install a malicious extension and steal GitHub OAuth tokens. It adds detail on the disclosure timeline, Askar's decision to publish within an hour of notifying a GitHub contact, and his stated dispute with MSRC over prior VS Code vulnerability handling.
info@thehackernews.com (The Hacker News)
2026.06.03
96% relevant
The article appears to cover the same underlying event: a one-click attack in GitHub Dev/github.dev related to VS Code that can steal full GitHub OAuth tokens and expose private repositories.
Sergiu Gatlan
2026.06.03
100% relevant
This article appears to be the first major report establishing a distinct public zero-day affecting VS Code/github.dev, with exploit code and immediate defender action needed.