VS Code Vulnerability Exposes GitHub OAuth Tokens to Attackers
In June 2026, a critical vulnerability was disclosed in Microsoft Visual Studio Code (VS Code) that allowed attackers to steal GitHub OAuth tokens through a single malicious link. Security researcher Ammar Askar demonstrated that by exploiting the webview implementation in VS Code, an attacker could execute malicious JavaScript to install a rogue extension, thereby capturing OAuth tokens with full read and write access to a user's repositories, including private ones. This vulnerability posed significant risks to developers, potentially exposing sensitive code and intellectual property. This incident underscores the growing threat of supply chain attacks targeting development environments. As developers increasingly rely on integrated tools and extensions, the security of these components becomes paramount. Organizations must remain vigilant, ensuring that their development tools are secure and up to date to prevent unauthorized access and data breaches.
Kill Chain
