On June 3, 2026, researcher Ammar Askar published exploit code for a Visual Studio Code zero-day vulnerability affecting github.dev — the browser-based code editor that GitHub surfaces when users press the . key on any repository page. The vulnerability allows an attacker to extract GitHub OAuth tokens by convincing a victim to click a single link.
Affected component: github.dev (browser-based VS Code instance)
Attack vector: Malicious link in PR comment, Issue, or direct message
Token scope: Unrestricted — all repositories the victim can access
Patch status: No patch available as of June 3, 2026
CVE: Not yet assigned
Askar published the vulnerability and a proof-of-concept exploit simultaneously, citing prior negative experiences with Microsoft's security response process regarding a previously reported VS Code vulnerability that was silently fixed without credit or acknowledgment of security impact.
To understand the vulnerability, we need to understand how github.dev authenticates users. When a user navigates to github.dev from a GitHub repository page, the following authentication flow occurs:
. or clicks a "View on github.dev" link on a GitHub repository page.This is by design: github.dev needs to list repositories, create pull requests, and perform other actions beyond viewing a single file. However, it creates a significant blast radius if the token is exfiltrated.
The exploit abuses VS Code's webview message-passing system — an inter-process communication mechanism designed to allow extensions rendered in sandboxed webviews to communicate with the main editor window. Here's how it works:
The attacker crafts a URL pointing to a github.dev page. This can be a link to any repository file or a specially crafted github.dev URL. When the victim clicks the link, github.dev opens in their browser and receives the OAuth token automatically.
github.dev uses VS Code's webview API to render certain UI components. The exploit injects malicious JavaScript into a webview context — a sandboxed iframe that typically has restricted access to the main editor's APIs and the browser's DOM.
VS Code extensions communicate with webviews through a postMessage() API. The exploit abuses this mechanism by simulating legitimate extension-to-webview messages. Specifically, it sends crafted messages that the main editor interprets as originating from a trusted extension, bypassing webview sandbox restrictions.
Once the attacker's code gains limited access to the main editor context, it uses keystroke injection — programmatically simulating keypresses that trigger VS Code commands. This approach installs a malicious VS Code extension by:
Ctrl+Shift+P)The installed malicious extension has full access to VS Code's extension API, including:
As Askar's exploit demonstrates, the extension can query the GitHub API to discover every private repository the victim has access to, making this far more damaging than just the repository trigger context suggests.
The VS Code zero-day exposes fundamental weaknesses in the current security model:
1. Unscoped OAuth Tokens. The decision to issue an unscoped OAuth token to github.dev creates maximum blast radius. A token that is scoped to a single repository would reduce impact. Per the OWASP API Security Top 10, excessive data exposure through improperly scoped API tokens is a critical vulnerability class.
2. Webview Sandbox Weakness. VS Code's webview sandbox relies on postMessage restrictions, but Askar demonstrated that crafted messages can bypass these checks. A more robust sandbox would use Content Security Policy (CSP) nonces and strict origin validation for inter-frame communication.
3. Automatic Token Injection. The automatic POST-based token injection means that merely opening a github.dev URL grants the page access to credentials. A user-confirmation dialog — similar to "Allow this site to open your GitHub connection?" — would prevent silent exploitation.
4. No Cryptographic Verification of Extension Sources. Installing an extension programmatically via keystroke injection works because VS Code does not cryptographically verify the extension's publisher identity against the installation request. A hardware-bound attestation mechanism for extension installations would prevent this.
Consider a typical development workflow: A maintainer of an open-source project receives a pull request with a comment suggesting "Can you check this fix on github.dev?" The maintainer clicks the link, and within milliseconds:
This scenario is not hypothetical. The Miasma supply chain attack disclosed on June 1, 2026 demonstrated the exact same attack pattern: compromised Red Hat npm packages used credential-stealing worms to harvest GitHub tokens and CI/CD secrets. The attacker used a compromised employee's GitHub account to push malicious pseudo-orphaned commits, bypassing code review entirely.
Similarly, the Megalodon campaign (May 2026) injected malicious GitHub Action workflows into 5,561 public repositories to harvest CI/CD secrets. The Nx Console VS Code extension compromise (May 2026) demonstrated that VS Code extensions themselves are an active attack surface.
Until Microsoft releases a patch, implement these mitigations:
gh api /orgs/{ORG}/actions/secrets/public-key
gh api /orgs/{ORG}/members --jq '.[].login' | while read user; do
echo "Checking $user..."
gh api /users/$user/events | jq '.[] | select(.type=="CreateEvent")'
doneAskar's decision to publish exploit code immediately — with only one hour's notice to GitHub — reflects a growing tension in the security research community. He explicitly stated: "That was mostly a courtesy to GitHub, the intent here was full public disclosure. In my past experience reporting github.dev bugs to them, they tell you that it's out of scope and go report it to MSRC."
This follows the pattern of Nightmare Eclipse, an anonymous researcher who has disclosed multiple Windows zero-days (BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, UnDefend) over the past months, citing frustration with Microsoft's Security Response Center (MSRC) handling. Microsoft responded with threats of legal action and a statement that they "will work with law enforcement as appropriate."
This escalation raises important questions about coordinated vulnerability disclosure (CVD). When a vendor's security response process is perceived as dismissive or adversarial, researchers may opt for public disclosure — creating immediate risk for users but applying maximum pressure for a fix. The ENISA guidelines on CVD recommend a maximum 90-day disclosure window; Askar's immediate public disclosure sits at the far end of the disclosure spectrum.
Does this vulnerability affect all VS Code users?
No. The vulnerability specifically targets github.dev (the browser-based version), not the locally installed VS Code application. Users who only use the desktop VS Code application are not directly exposed. However, if they ever click a github.dev link from a repository, they are at risk during that session.
Can this be exploited without user interaction?
The current proof-of-concept requires a single click on a malicious link. Askar's exploit requires the victim to click a URL that opens github.dev. No additional interaction (password entry, file download, permission grant) is needed after the initial click.
How does this compare to the Nx Console VS Code extension compromise?
The Nx Console attack (May 2026) involved compromising a legitimate extension's update pipeline. The VS Code zero-day allows installation of a new malicious extension without any extension marketplace interaction. Both attack vectors target VS Code but through entirely different mechanisms.
What should I tell my development team?
Immediately: clear github.dev browser data and rotate personal access tokens. Medium-term: implement OIDC-based authentication for CI/CD pipelines and enforce granular token scoping. Long-term: evaluate whether browser-based code editors are necessary for your workflow and consider the security trade-offs.
Will CSPRNG-based tokens help here?
No. The vulnerability targets OAuth tokens regardless of how they were generated — whether from a cryptographically secure random number generator (CSPRNG) or otherwise. The issue is not token quality but token management: automatic injection, unscoped access, and lack of user consent. Use a CSPRNG-based key generator for passwords and API keys, but understand that OAuth token architecture is a separate concern.
Affiliate Disclosure: This post may contain affiliate links. If you purchase through these links, we may earn a small commission at no extra cost to you. SecureKeyGen is free to use. Full disclosure.