MicrosoftGHSA-qcxw-jfff-cxpc
GitHubCredentialProvider - Regex substring host match sends Basic-auth tokens
HighCVE-2026-47284 · Published Jun 9, 2026
### Impact A security feature bypass vulnerability exists in VS Code's built-in GitHub extension, where `GitHubCredentialProvider` validated the request host using the unanchored regex `/github\.com/i`. Because the pattern is a substring match (no `^`/`
anchors), hostnames such as `github.com.attacker.example` or `notgithub.com` were treated as GitHub and received the signed-in user's token via HTTP Basic authentication. A malicious repository can include a `.gitmodules` entry pointing to such a host; when the victim runs `Git: Clone (Recursive)` or `git submodule update` from inside VS Code, the credential helper sends the GitHub token to the attacker. Note that this overrides Git's own credential lookup (which performs strict host matching) and is not gated by workspace trust because credential delivery happens during the clone step.
### Patches
The fix replaces the substring regex with port-stripped, case-insensitive equality against `github.com`. Available in VS Code **1.123.1**.
### Workarounds
There is no setting-based workaround. Until upgrade, avoid recursive clones or `git submodule update` of untrusted repositories from inside VS Code while signed in to GitHub, ins...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.123.1 | 1.123.1 |
Details and references
### Impact A security feature bypass vulnerability exists in VS Code's built-in GitHub extension, where `GitHubCredentialProvider` validated the request host using the unanchored regex `/github\.com/i`. Because the pattern is a substring match (no `^`/`
anchors), hostnames such as `github.com.attacker.example` or `notgithub.com` were treated as GitHub and received the signed-in user's token via HTTP Basic authentication. A malicious repository can include a `.gitmodules` entry pointing to such a host; when the victim runs `Git: Clone (Recursive)` or `git submodule update` from inside VS Code, the credential helper sends the GitHub token to the attacker. Note that this overrides Git's own credential lookup (which performs strict host matching) and is not gated by workspace trust because credential delivery happens during the clone step.
### Patches
The fix replaces the substring regex with port-stripped, case-insensitive equality against `github.com`. Available in VS Code **1.123.1**.
### Workarounds
There is no setting-based workaround. Until upgrade, avoid recursive clones or `git submodule update` of untrusted repositories from inside VS Code while signed in to GitHub, inspect `.gitmodules` for suspicious submodule URLs first, or sign out of GitHub when working with untrusted code.
### References
- Public issue: [#320634](https://github.com/microsoft/vscode/issues/320634)
- Patch commit: [`4b6e246`](https://github.com/microsoft/vscode/commit/4b6e2467dbd828018d602f73cc25d1b11f699d2c)
- MSRC advisory: [CVE-2026-47284](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47284)
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 2 | Microsoft 365 Copilot: open redirect | Critical9.3 | No fix yet |
| Jul 2 | Microsoft Azure Synapse: improper access control | Medium4.8 | No fix yet |
| Jul 1 | Microsoft Edge (Chromium-based): use after free | High8.3 | 149.0.4022.68 |
| Jun 9 | Path traversal in profile snippets import allows writing files outside the profile directory (Zip-Slip) | Medium | 1.123.1 |
| Jun 9 | Auto-Approved File Write via Unconfirmed Environment-Variable Path Redirection | Low | 1.123.1 |
| Jun 9 | Unconfirmed Remote Host Connection via Workspace File | High | 1.123.1 |
Critical advisories by email
Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.