--- title: VS Code zero-day lets hackers steal GitHub tokens in one... description: A security researcher (Ammar Askar) has publicly disclosed a zero-day vulnerability in VS Code that allows attackers to steal GitHub OAuth tokens with a single... canonical: https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: VS Code zero-day lets hackers steal GitHub tokens in one click | daily.dev og:description: A security researcher (Ammar Askar) has publicly disclosed a zero-day vulnerability in VS Code that allows attackers to steal GitHub OAuth tokens with a single... og:url: https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn og:image: https://api.daily.dev/og/posts/DG7cfN1YN.png og:image:alt: VS Code zero-day lets hackers steal GitHub tokens in one click og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # VS Code zero-day lets hackers steal GitHub tokens in one click **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 1 comments ## Summary A security researcher (Ammar Askar) has publicly disclosed a zero-day vulnerability in VS Code that allows attackers to steal GitHub OAuth tokens with a single click. The exploit abuses VS Code's sandboxed webview message-passing system to install a malicious extension that extracts GitHub tokens passed to github.dev, granting full access to all private repositories the victim can access. No CVE has been assigned and no patch is available yet. Users can mitigate by clearing cookies and local site data for github.dev. The researcher chose immediate full public disclosure citing a prior negative experience with Microsoft's Security Response Center (MSRC), which previously silently fixed a reported bug without credit. The disclosure is part of a broader pattern of researchers bypassing MSRC due to frustration with its handling of VS Code vulnerabilities. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@baptistecrouzet** · 0 upvotes > Please do not steal my Github Copilot access, we already lake of AI credits ! ## Similar posts on daily.dev - [GitHub.dev flaw lets attackers steal OAuth tokens in one click](https://daily.dev/posts/github-dev-flaw-lets-attackers-steal-oauth-tokens-in-one-click-tounneovz) · The Next Web · 0 upvotes · 0 comments - [1-Click GitHub Token Stealing via a VSCode Bug](https://daily.dev/posts/1-click-github-token-stealing-via-a-vscode-bug-bjvyhct2p) · Lobsters · 0 upvotes · 0 comments - [Hole in GitHub’s browser-based VSCode editor could lead to stolen token](https://daily.dev/posts/hole-in-github-s-browser-based-vscode-editor-could-lead-to-stolen-token-mfj7z99ko) · InfoWorld · 0 upvotes · 0 comments - [Your IDE is an Attack Vector](https://daily.dev/posts/your-ide-is-an-attack-vector-6mrqzzvv0) · DEV · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#vscode](https://daily.dev/tags/vscode), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"VS Code zero-day lets hackers steal GitHub tokens in one click","url":"https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn"},"datePublished":"2026-06-03T06:51:22.692Z","dateModified":"2026-06-03T06:51:47.192Z","description":"A security researcher (Ammar Askar) has publicly disclosed a zero-day vulnerability in VS Code that allows attackers to steal GitHub OAuth tokens with a single...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/31fa6a4b1801f438da15376c594bdb9c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/31fa6a4b1801f438da15376c594bdb9c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,github,vscode,zero-day","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"VS Code zero-day lets hackers steal GitHub tokens in one click"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click-dg7cfn1yn","comment":[{"@type":"Comment","text":"Please do not steal my Github Copilot access, we already lake of AI credits !","datePublished":"2026-06-03T08:22:15.476Z","url":"https://daily.dev/posts/DG7cfN1YN#c-gFeLJJqIB","author":{"@type":"Person","name":"Baptiste Crouzet","url":"https://daily.dev/baptistecrouzet","image":"https://avatars0.githubusercontent.com/u/26898487?v=4"}}]} ```