{"id":263000,"date":"2026-06-03T08:58:00","date_gmt":"2026-06-03T12:58:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/03\/one-click-github-dev-attack-lets-attackers-steal-full-github-oauth-tokens\/"},"modified":"2026-06-03T10:20:08","modified_gmt":"2026-06-03T14:20:08","slug":"one-click-github-dev-attack-lets-attackers-steal-full-github-oauth-tokens","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/03\/one-click-github-dev-attack-lets-attackers-steal-full-github-oauth-tokens\/","title":{"rendered":"One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens"},"content":{"rendered":"

One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/06\/one-click-github-dev-attack-lets.html<\/a><\/p>\n

Publish Date: 2026-06-03 08:58:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Jun 03, 2026<\/span><\/span>Vulnerability \/ Software Development<\/span><\/p>\n

Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user’s GitHub token.<\/p>\n

“Just by clicking a link, it’s possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones,” security researcher Ammar Askar said.<\/p>\n

GitHub supports a feature called GitHub.dev that runs as a lightweight web-based source code editor in the web browser’s sandbox by launching a VS Code environment. It allows users to send pull requests and make commits.<\/p>\n

“This functionality is achieved by github.com POSTing over an OAuth token to github.dev that allows it to interact with GitHub on your behalf,” Askar said. “The token is not scoped to the particular repo you interacted with, meaning it has full access to every other repo that you have access to.”<\/p>\n

In a nutshell, the vulnerability allows attackers to install malicious VS Code extensions that steal GitHub OAuth tokens when they are passed to GitHub.dev by exploiting a message-passing mechanism between the main VS Code window and webviews. Webviews are used to render Markdown previews or edit Jupyter notebooks.<\/p>\n

\"\"<\/p>\n

Specifically, the exploit runs malicious JavaScript inside an untrusted webview to simulate keypresses (aka keydown events) in the main editor window, open the Command Palette by triggering “Ctrl+Shift+P,” and install an attacker-controlled extension that extracts the GitHub OAuth token sent to GitHub.dev and queries the GitHub API to enumerate all private repositories the victim can access.<\/p>\n

It’s worth noting the approach also leverages a VS Code feature called local workspace extensions that allows an extension to be directly installed without presenting any additional trust dialog prompt as long as it’s placed in the “.vscode\/extensions” folder within that workspace, effectively bypassing the publisher trust check.<\/p>\n

“This is just…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens https:\/\/thehackernews.com\/2026\/06\/one-click-github-dev-attack-lets.html Publish Date: 2026-06-03…<\/p>\n","protected":false},"author":1,"featured_media":263001,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgeHvqmNHvAhdxgoBLbfFWsFBMdvH5SbJovunxx8AYHRkq7HOQ2l6I_ZaJGi_PF5WHKOlHEQHK4HyPBhmzOpYNhPS4HJSna2uLVlEwUV9i2j5YuRqGOLUqgKIrhx2ndFm1OSME7usiLk_ohtIBYyR5Xpq5Pzc2eHAjCK0OA_89JwPNxVrrBVDbTDRVbRG6e\/s1600\/github.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,31,27],"class_list":["post-263000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-exploit","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/263000"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=263000"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/263000\/revisions"}],"predecessor-version":[{"id":263002,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/263000\/revisions\/263002"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/263001"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=263000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=263000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=263000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}