1-Click GitHub Vulnerability Enables OAuth Token Theft

A newly disclosed vulnerability in GitHub’s browser-based editor, GitHub.dev, allows attackers to steal powerful OAuth tokens with just a single click, giving them read and write access to private repositories.

The flaw exploits how Visual Studio Code (VSCode) webviews handle keyboard events and message passing, enabling a malicious repository to execute attacker-controlled actions inside the browser-based editor and exfiltrate GitHub tokens.

1-Click GitHub Vulnerability

GitHub’s github.dev feature provides a lightweight, browser-based version of VSCode that can be launched simply by changing a repository URL from github.com to github.dev or by selecting the corresponding UI option.

When a user opens a repository in GitHub.dev, GitHub posts an OAuth token to the web-based editor to allow it to interact with GitHub on the user’s behalf. This token is not scoped to a single repository.

Instead, it provides access to all repositories the user can reach, including private ones. This broad token scope and the complexity of VSCode’s large TypeScript codebase running in the browser make github.dev an attractive target for security researchers and attackers.

VSCode relies on webviews, implemented as iframes with distinct origins, to safely render dynamic content such as Markdown previews and Jupyter notebook outputs without granting them direct access to the main editor’s DOM or Node.js APIs.

This isolation is enforced using the browser’s same-origin policy and strengthened with defense-in-depth measures such as strict Content Security Policy (CSP) rules and input sanitization for webview content.

To enable features like synchronized scrolling and live previews, the main VSCode window and the webview communicate via the Window.postMessage API, exchanging structured messages that describe user actions rather than sharing DOM or script context directly.

Despite the isolation, VSCode’s UX requirements cause webviews to forward keyboard events to the host so that global shortcuts like Ctrl+Shift+P work even when focus is inside a webview.

The webview registers a keydown handler that posts did-keydown messages to the host, including key codes and modifier states, so that the main VSCode process can treat them as user input.

The bug arises because untrusted webview content, such as a notebook cell with embedded JavaScript, can programmatically generate these keyboard events, effectively simulating user keystrokes and driving sensitive workflows like extension installation without real user interaction.

Exploitation Technique

The exploitation chain is built around VSCode’s keyboard shortcuts and local workspace extensions, and it unfolds in several steps:

• A malicious GitHub repository is set up with a Jupyter notebook and a local workspace extension definition in the .vscode directory, including a crafted package.json that adds dangerous keybindings.
• When a victim opens the notebook via a specially crafted GitHub.dev link, a Markdown cell injects JavaScript that waits for GitHub.dev to load, then dispatches synthetic keydown events.
• These fake keystrokes first trigger the “Notifications: Accept Notification Primary Action” shortcut (Ctrl+Shift+A) to accept the workspace’s recommended extension, then invoke a custom keybinding (for example, Ctrl+F1) that runs workbench.extensions.installExtension with publisher trust checks bypassed.
• Once the attacker-controlled extension is installed and activated, it programmatically accesses the GitHub OAuth token used by github.dev, queries the GitHub API (such as the /user/repos endpoint), and exfiltrates repository data and the token value to the attacker’s controlled channel.

If successfully exploited, this bug allows an attacker to obtain an OAuth token that can read and write to any repository the victim can access, including private codebases.

With this level of access, attackers can clone or leak proprietary code, inject backdoors into software supply chains, tamper with configuration files, or plant malicious changes that appear to come from legitimate contributors.

On desktop VSCode, a similar chain combined with other webview-based XSS or content-injection issues could escalate to full remote code execution. However, it requires more user interaction than the single-click GitHub.dev scenario.

From a defender’s perspective, this attack leaves several potential indicators of compromise. Organizations may observe unexpected installation of VSCode extensions, particularly those configured as local workspace extensions under project-specific .vscode folders, that do not match standard tooling.

Security logs and GitHub audit trails may show anomalous access to private repositories, unusual API calls to GitHub endpoints from browser sessions, or unfamiliar OAuth authorizations and token usage patterns.

Users who have interacted with github.dev should clear their cookies and local storage for the GitHub.dev domain so that any existing trust dialogs are re-presented, giving them a chance to abort if redirected to suspicious links.

Organizations should discourage opening untrusted repositories or notebooks directly via GitHub.dev links, regularly review installed VSCode extensions across developer environments, and prefer fine-grained GitHub tokens and OAuth restrictions to limit blast radius in case of token theft.

Monitoring GitHub security logs for unusual OAuth activity and repository access, combined with secret scanning to detect hardcoded credentials, further reduces the impact of any stolen tokens.

The researcher ammaraskar chose full public disclosure for this VSCode bug, citing prior negative experiences with the Microsoft Security Response Center (MSRC), including uncredited fixes and low-severity classifications for impactful VSCode vulnerabilities. This incident highlights the tension between usability and security in modern browser-based IDEs.

It shows how seemingly benign UX optimizations, like forwarding keyboard shortcuts from webviews, can undermine isolation boundaries if not carefully constrained.

For defenders and platform engineers, it reinforces the need to validate event origins, minimize implicit trust in cross-context communications, and design OAuth tokens with strict scoping to prevent single-token compromise from cascading across all developer assets.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.