VS Code Extension Vulnerability in GitHub Workflow Updater

CVE-2025-62794

What is CVE-2025-62794?

The GitHub Workflow Updater, a Visual Studio Code extension designed to enhance security by pinning GitHub Actions to specific commits, suffers from a significant security design flaw. In versions prior to 0.0.7, the extension improperly stored GitHub tokens in plaintext within the editor's configuration as JSON files on disk instead of utilizing the more secure 'securestorage' API. This flaw allows attackers with read-only access to the user’s home directory to potentially extract sensitive tokens. If exploited, these tokens could be misused to perform unauthorized actions. Users are strongly advised to update to version 0.0.7 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References