VS Code Vulnerability Allows Stealing GitHub Tokens in One Click

A cybersecurity researcher has disclosed an exploit for a critical vulnerability in the popular code editor Visual Studio Code (VS Code). The issue enables attackers to gain access to GitHub authentication tokens if the victim clicks on a malicious link.

The vulnerability affects the VS Code GitHub integration mechanism, widely used by developers for repository management and collaboration. The expert noted that a single click on a link is sufficient for a successful attack, making the threat especially dangerous amid phishing campaigns.

At the time of publication, the VS Code developers had not released a patch. However, experts recommend users exercise caution when clicking links from untrusted sources. Special attention should be paid to verifying URLs and disabling automatic authentication in the editor.

GitHub tokens are frequently used to access repositories, CI/CD systems, and other services, so their compromise could lead to severe consequences, including source code leaks and unauthorized access to infrastructure.