Security Researcher Releases Exploit Code for Visual Studio Code Zero-Day Vulnerability

A security researcher has released exploit code for a zero-day vulnerability in Microsoft's Visual Studio Code that enables attackers to steal GitHub authentication tokens by tricking users into clicking a malicious link.

The vulnerability, disclosed on June 3, 2026, affects the popular code editor used by millions of developers worldwide. The exploit code was published by Ammar Askar, a security researcher, following a report by Sergiu Gatlan of BleepingComputer. The flaw allows threat actors to bypass security controls and access sensitive credentials stored within the application.

When a user opens a malicious file or clicks a crafted link within Visual Studio Code, the exploit triggers an unauthorized action that extracts GitHub tokens. These tokens grant access to private repositories, codebases, and other sensitive information linked to the user's GitHub account. Once compromised, attackers can clone repositories, modify code, or deploy malicious payloads without further user interaction.

Microsoft has not yet issued a public statement regarding the vulnerability or the release of the exploit code. The software giant typically addresses such issues through its security advisory channels, but no patch or mitigation guidance has been released as of the disclosure date. Developers are advised to exercise caution when opening files from untrusted sources and to avoid clicking on unsolicited links within the application.

The release of the exploit code raises concerns about the potential for widespread exploitation. Security experts warn that threat actors could use the vulnerability to target high-value organizations or individuals with access to critical code repositories. The timing of the disclosure, occurring shortly after the initial report, suggests a coordinated effort to highlight the severity of the flaw.

Visual Studio Code remains one of the most widely used integrated development environments, with millions of daily active users. The vulnerability underscores the importance of keeping software updated and maintaining strict security practices when handling external files. Developers are encouraged to review their security settings and consider additional protective measures until an official fix is available.

The full scope of the vulnerability's impact remains unclear. Questions persist regarding whether any organizations have already been targeted using this exploit. Additionally, it is unknown if the vulnerability affects other versions of the software or related tools in the Microsoft ecosystem.

As of now, no confirmed incidents have been reported, but the availability of the exploit code increases the risk of active exploitation. Security teams are advised to monitor for suspicious activity and prepare contingency plans in case of a breach. The situation remains fluid as Microsoft and the broader security community assess the threat and work toward a resolution.