1-Click GitHub Token Stealing via a VSCode Bug

A security researcher has published details of a one-click attack that can steal a GitHub access token — one that can read and write to a victim's repositories, including private ones — through a bug in the web version of Visual Studio Code. The write-up appeared on the researcher's blog and on the VSCode issue tracker on June 2nd.

The flaw in the sandbox

The target is github.dev, GitHub's browser-based editor: opening any repository there hands the web app an OAuth token that github.com posts to github.dev. That token is not scoped to the repository you opened, so it grants access to every other repository the signed-in user can reach. VSCode normally keeps code running inside its webviews — markdown previews, Jupyter notebooks — in a cross-origin iframe, isolated from the main editor. The bug is that webviews forward keyboard events to the parent window through VSCode's message-passing API, so script running inside an untrusted webview can synthesise keystrokes that the editor treats as coming from the user.

From a notebook cell to a stolen token

The proof of concept needs only a repository containing a Jupyter notebook and a "local workspace extension". A markdown cell whose image tag has an onerror handler that runs JavaScript starts the chain: the script waits for VSCode's recommended-extensions notification, sends Ctrl+Shift+A to accept its primary action, and installs the local extension — a route that skips the publisher-trust prompt because the workspace itself is treated as trusted. That extension then contributes a custom keybinding which calls the command to install a chosen marketplace extension while skipping the publisher check; the installed extension reads the GitHub token and queries api.github.com/user/repos, printing the private repositories the token can reach. The same flaw exists in desktop VSCode, though it is harder to exploit: the victim must clone the repository and open the notebook, and combined with a webview cross-site scripting bug it would amount to remote code execution.

Fixes and user advice

Microsoft shipped a stopgap fix on June 3rd, adding a confirmation step when notebooks are opened in the web editor and preventing commands from skipping publisher trust; a fuller fix followed the same day, stopping keydown events from bubbling out of notebook webviews. Users who have never opened github.dev are advised to clear its cookies and site data — once past the initial sign-in dialog, the researcher notes, no CSRF tokens protect the editor, so any link on the internet can redirect a browser into the attack. The author also credits VSCode's defence-in-depth, including a strict content security policy and markdown sanitisation, with limiting the damage, and explains the decision to disclose publicly after an earlier report was fixed silently and without credit.