Researcher Drops a New VS Code Zero-Day After Losing Trust in Microsoft’s Disclosure Process
Source Reddit Cybersecurity
Rated by Threat Radar
Data as of 4 Jun 2026, 10:18 UTC
What to do
AI-suggested
Until an official fix is available, users should exercise caution when opening repositories in github.dev, especially those from untrusted sources or with modified .vscode/extensions.json files. Avoid clicking suspicious github.dev links and monitor for updates from Microsoft regarding this vulnerability. The researcher’s public disclosure indicates no coordinated fix or official acknowledgment has been provided yet.
Discussion
A security researcher publicly disclosed a critical zero-day vulnerability in Visual Studio Code's browser-based editor github.dev after losing trust in Microsoft's security response process. The vulnerability allows an attacker to steal OAuth tokens with broad repository access by exploiting how github.dev receives tokens from github.com without repo-specific scoping. An attacker who can modify a repository's . vscode/extensions.json can recommend a malicious extension that installs automatically when the victim opens the repo in github.dev, bypassing user approval via a hidden Jupyter Notebook trigger. This enables silent installation of malicious extensions capable of stealing tokens and accessing private repositories.
r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments