NewsSecurityWeek
VS Code Vulnerability Allows One-Click GitHub Token Theft
Teaser from the source
A researcher has disclosed the full details of the vulnerability and released a PoC without notifying Microsoft in advance. The post VS Code Vulnerability Allows One-Click GitHub Token Theft appeared first on SecurityWeek .
This is the RSS-feed teaser. Read the full article at the original source.
Read at SecurityWeekMore on GitHub
Other advisories
- HighCVE-2026-125329Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13…
- MediumCVE-2026-119976External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose informati…
- MediumCVE-2026-83953Microsoft GitHub Copilot Plugin for JetBrains IDEs: Befehlsinjektion
- MediumCVE-2026-83953Microsoft GitHub Copilot Plugin for JetBrains IDEs: Befehlsinjektion
- MediumCVE-2026-83953Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information l…
- MediumCVE-2026-123369compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
- MediumCVE-2026-123369compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
- MediumCVE-2026-83953GitHub Copilot for Jetbrains Information Disclosure Vulnerability
Other news entries
- AI Coding Agents Leak Thousands of Secrets to GitHubNewsDark Reading
- Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix ConfirmedNewsThe Hacker News
- Claude Code is accidentally exposing secrets all over GitHubNewsArs Technica — Security
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubNewsThe Hacker News
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Fake security tools on GitHub push backdoors and infostealersNewsBleepingComputer
- Threat actors use agentic AI tooling to find and abuse exposed secretsNewsMicrosoft Threat Intelligence
Source: https://www.securityweek.com/vs-code-vulnerability-allows-one-click-github-token-theft/
ID