GitHub Workflow Updater CVE-2025-62794

Exploitation requires that the victim previously entered a GitHub Personal Access Token via the extension's 'github-workflow-updater.githubToken' setting in versions before 0.0.7, causing it to be written in plaintext to the VS Code editor configuration JSON on disk. The attacker must then have local read access to the victim's home directory (where VS Code stores user settings) - i.e., a local account, a malicious local process, or another host compromise. Limiting factors: no token stored means nothing to steal; the fixed 0.0.7 release migrates tokens to the VS Code secret storage API, so patched installs are not exposed; and there is no remote or network-triggerable path - the attacker gains nothing without pre-existing local filesystem read access.

This is a genuinely low-priority, low-real-risk issue despite being a valid credential-protection flaw (CWE-522). All signals align in the low-risk direction rather than conflicting: the CVSS base score is only 3.8 with a local attack vector (AV:L), low complexity (AC:L) and required pre-existing low privileges (PR:L); EPSS is 0.13% (2nd percentile), indicating essentially no predicted exploitation activity; the CVE is NOT on CISA KEV; and no public exploit code is referenced. The SSVC-style read is: exploitation is low/none, the flaw is not meaningfully automatable (it requires an attacker to already hold local read access to the victim's home directory), and technical impact is partial (C:L only - token disclosure, no integrity or availability impact to the host). The one amplifying factor is Scope:Changed, reflecting that the leaked GitHub token can be abused against the victim's remote GitHub resources - so impact crosses a trust boundary even though the host impact is minor. The critical limiting factor, which the raw CVSS does not fully convey, is the precondition: an adversary must ALREADY be able to read files in the user's home directory, meaning local account access or another compromise is a prerequisite. This is a defense-in-depth / hardening fix, not an urgent, independently exploitable network vulnerability.

A local user or malicious process with read access to the victim's home directory locates the VS Code settings JSON where the 'github-workflow-updater.githubToken' value was stored in plaintext, reads the GitHub Personal Access Token, and then uses that token to authenticate to GitHub and act with the victim's permissions (e.g., accessing private repositories). No public exploit code is referenced; exploitation requires pre-existing local read access rather than any remote trigger.