Product
github.dev
- First Reported
- Jun 3, 2026
- Latest Reported
- Jun 4, 2026
Reported Context (3)
- hole involves an attacker creating a specially crafted Jupyter notebook. When someone opens it on github.dev, a lightweight version of VS Code that runs entirely in the web browser, hidden code inside the VS Code Flaw Lets Malicious Notebooks Steal GitHub Tokens
- A one-click attack in Microsoft Visual Studio Code and GitHub.dev can let an attacker steal a victim’s GitHub OAuth token after they click a crafted link. One-Click Attack Can Steal GitHub OAuth Tokens Through GitHub.dev and VS Code Webviews
- The flaw can be abused through github.dev to install a malicious extension and enumerate private repositories accessible to the victim. VS Code Zero-Day Can Steal GitHub OAuth Tokens via Malicious Link
People (3)
MITRE ATT&CK (6)
Vendors (2)
Products (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.