A Single Click in VSCode Could Hand an Attacker Your GitHub Token

A researcher demonstrated how a crafted workspace file can silently exfiltrate the authentication token GitHub's official extension stores in VS Code — no malware required.

Written by Iris Vale · Bureau Tech · Jun 3, 2026

What the researcher found

Security researcher Ammar Askar published a technical write-up describing a one-click attack path that can extract a GitHub OAuth token from a developer's local machine using nothing more than a malicious VS Code workspace file.

The mechanism, as Askar describes it, abuses how the GitHub Pull Requests and Issues extension — an official Microsoft extension with tens of millions of installs — processes certain URI (Uniform Resource Identifier) callbacks. A URI callback is a redirect mechanism extensions use to receive data from external services, including authentication responses from GitHub's OAuth flow.

Askar's proof-of-concept demonstrates that a crafted workspace file can invoke one of these callbacks in a way that causes the extension to forward a stored authentication token to an attacker-controlled endpoint. The user's required action: open the file.

Why Workspace Trust doesn't close the gap

VS Code introduced Workspace Trust in 2021 as a way to limit what code and configuration can execute when a folder is opened from an untrusted source. It is the primary user-facing control for this category of risk.

According to Askar's write-up, the attack path he identified is not fully blocked by Workspace Trust in its default configuration. The specific extension behavior that enables the token theft is, he argues, reachable even when the workspace is marked untrusted. This is the technically significant claim in the research — and it is the one that most warrants independent verification and a vendor response.

What is actually at risk

A GitHub OAuth token is a credential. Depending on the scopes granted when the token was issued, an attacker who obtains one could read private repositories, interact with issues and pull requests, or take actions on behalf of the authenticated user within those permission boundaries.

The research does not claim — and this article does not assert — that any tokens have been stolen in the wild. The distinction between a demonstrated proof-of-concept and an actively exploited vulnerability matters, and it is worth holding until Microsoft or GitHub publishes a formal advisory.

Who carries the most practical risk

Developers who routinely clone repositories from unfamiliar sources, open workspace files shared over chat or email, or work in environments where untrusted code regularly passes through their local machine are most exposed to this class of attack.

The attack requires the target to open a file — it is not a remote code execution vulnerability that operates without user interaction. That is a meaningful constraint, though not a reason for complacency given how normalized opening workspace files is in developer workflows.

What to watch for

Neither Microsoft nor GitHub had published a public advisory at the time this article was prepared. Developers should monitor the official VS Code release notes and the GitHub Security Advisories feed for a patch or mitigation guidance. Revoking and reissuing GitHub tokens is a low-friction precaution available now through GitHub's token management settings, regardless of whether a patch has shipped.

Key takeaways

The attack vector is a specially crafted .code-workspace file — opening it in VS Code is sufficient to trigger token exfiltration under the conditions described.
The target is the OAuth token stored by the GitHub Pull Requests and Issues extension, which grants API access to repositories, issues, and pull requests scoped to that token.
Workspace Trust — VS Code's built-in sandbox boundary — does not fully mitigate this class of attack as described in the research.
'Potentially affected' and 'confirmed compromised' are not the same status; no evidence of in-the-wild exploitation has been cited in the primary source.
Developers who regularly open repositories or workspace files from untrusted sources carry the highest practical risk.

FAQ

Do I need to run any code for this attack to work?

Based on the researcher's description, opening a malicious .code-workspace file in VS Code is the only required user action. No separate code execution step is described in the proof-of-concept.

Does disabling the GitHub Pull Requests and Issues extension mitigate the risk?

The attack path described targets that specific extension's URI callback handling. Disabling or uninstalling it would remove the described vector, though you would also lose the extension's functionality. Confirm with official guidance before treating this as a complete fix.

How do I check or revoke my GitHub tokens?

GitHub tokens can be reviewed and revoked at github.com/settings/tokens. OAuth tokens granted to applications appear under 'Authorized OAuth Apps' in the same settings area.

Has this been exploited in the wild?

No evidence of in-the-wild exploitation has been cited in the primary research or in any vendor advisory available at time of publication. This remains a proof-of-concept finding.

What is Workspace Trust and why doesn't it prevent this?

Workspace Trust is a VS Code feature that restricts what tasks, settings, and extensions can do when a folder is opened from an untrusted source. The researcher's claim is that the specific extension behavior enabling this attack is reachable even in an untrusted workspace context. Microsoft has not publicly confirmed or disputed that characterization as of publication.

Citations

1-Click GitHub Token Stealing via a VSCode BugProof-of-concept demonstrating GitHub token exfiltration via a crafted VS Code workspace file using the GitHub Pull Requests extension's URI callback handling.
Hacker News discussion threadSecondary source surfacing the research; used for discovery context only.
VS Code Workspace Trust documentationOfficial documentation describing the Workspace Trust feature and its intended security boundaries.
GitHub token management settingsOfficial GitHub interface for reviewing and revoking personal access tokens and OAuth app authorizations.