VS Code zero-day lets hackers steal GitHub tokens in one click

A security researcher released exploit code for a VS Code zero-day vulnerability that enables attackers to steal GitHub authentication tokens by tricking users into clicking a link. The exploit targets a flaw in VS Code's handling of web links in the editor. Attackers can extract GitHub tokens with minimal user interaction. The vulnerability allows full access to a user's GitHub account. The researcher disclosed the exploit code to improve public awareness. The flaw affects all versions of VS Code prior to version 1.88.0.