This VS Code zero-day vulnerability enables attackers to steal GitHub OAuth tokens by exploiting the sandboxed webview message-passing system in github.dev. The attacker can run malicious JavaScript inside a webview to simulate keypresses, install a malicious extension, and extract the OAuth token passed to github.dev. This token is not scoped to a single repository but grants access to all repositories the user can access. The proof-of-concept exploit was publicly released by security researcher Ammar Askar, who disclosed the issue immediately after notifying GitHub. No official patch or CVE has been issued yet. Users can protect themselves by clearing github.dev cookies and local site data to force re-authentication prompts.

If exploited, attackers can obtain GitHub OAuth tokens with broad access to the victim's repositories, potentially exposing private code and data. The token allows interaction with GitHub on the user's behalf across all accessible repositories. This could lead to unauthorized access and enumeration of private repositories. However, there are no reports of active exploitation in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should clear cookies and local site data for github.dev in their browsers to trigger the GitHub sign-in prompt when clicking links, which can help detect and block attempts to exploit this flaw. Monitor official vendor advisories for updates and patches. Avoid clicking suspicious links related to github.dev until a fix is released.