A security researcher published working exploit code targeting an unpatched zero-day issue in Visual Studio Code that lets attackers grab GitHub authentication tokens simply by getting victims to click a malicious link.

Microsoft labels a flaw as a zero-day when it becomes public or sees active exploitation before any official fix exists.

Researcher Ammar Askar detailed in a Tuesday blog post how the VS Code issue lets attackers deploy harmful extensions that capture GitHub OAuth tokens passed to github.dev, the browser edition of the editor, by abusing the sandboxed webview messaging mechanism.

The proof-of-concept released the same day runs malicious JavaScript inside a webview to mimic keystrokes in the editor, installs an extension, pulls the OAuth token delivered to github.dev, and then queries the GitHub API to list every private repository the victim can reach.

"This functionality is achieved by github.com POSTing over an OAuth token to github.dev that allows it to interact with GitHub on your behalf," Askar said. "The token is not scoped to the particular repo you interacted with, meaning it has full access to every other repo that you have access to."

Because no patch exists and no CVE has been assigned yet, VS Code users can defend themselves by clearing cookies and local data for github.dev through the browser settings menu under Cookies and site data, then Manage on-device site data.

Doing so forces a sign-in prompt warning that appears when users click links designed to exploit the flaw.

Askar notified GitHub one hour before going public and opted for immediate disclosure after a prior poor experience with Microsoft security response, where another VS Code report was fixed quietly without credit or recognition of its security implications.

"That was mostly a courtesy to GitHub, the intent here was full public disclosure. In my past experience reporting github.dev bugs to them, they tell you that it's out of scope and go report it to MSRC. And as I outlined in the article, I really don't want to deal with MSRC on VSCode bugs," he added.

"To summarize the last time I interacted with MSRC regarding reporting a VSCode bug, it was a horrible experience where they silently fixed the bug I pointed out without any credit. They also marked it as not having any security impact."

"As I mentioned in that post, going forward I would be doing full public disclosure for any security bugs I found in VSCode."

The disclosure comes after a series of zero-days in Microsoft products released by an anonymous researcher known as Nightmare Eclipse, who also voiced frustration with the Microsoft Security Response Center handling of reports.

In recent months Nightmare Eclipse published details on BlueHammer, RedSun, GreenPlasma, and MiniPlasma privilege-escalation flaws, YellowKey affecting Windows BitLocker, and UnDefend that can block Microsoft Defender updates.

Microsoft initially responded to those leaks with legal warnings and later stated it would cooperate with law enforcement when individuals cause harm through malicious activity.

BleepingComputer contacted Microsoft for comment on the VS Code zero-day but received no immediate reply.