PT-2025-44215 · Microsoft+1 · Vscode+1

Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-62794

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitHub Workflow Updater versions prior to 0.0.7

Description The GitHub Workflow Updater VS Code extension had a security issue where GitHub tokens were stored in plaintext within the editor configuration as JSON on disk, instead of utilizing the secure storage API. This meant an attacker with read access to a user's home directory could potentially access the token and use it to perform actions.

Recommendations Update to version 0.0.7.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-62794

GHSA-679X-97JW-8VJP

Affected Products

Github Workflow Updater

Vscode

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62794.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62794 · Security Note
• https://github.com/microsoft/vscode-discussions/discussions/748 · Note
• https://github.com/RichardoC/github-workflow-updater-extension/security/advisories/GHSA-679x-97jw-8vjp · Note
• https://twitter.com/VulmonFeeds/status/1983376839994224921 · Twitter Post
• https://twitter.com/CVEnew/status/1983281365056458981 · Twitter Post
• https://t.me/CVEtracker/36003 · Telegram Post
• https://github.com/RichardoC/github-workflow-updater-extension/commit/b9518c38ac6bc2a9fda2242e6daef17f7184ad1f · Note