GitHub Codespaces RCE via VS Code Configuration Files
GitHub Codespaces RCE via VS Code Configuration Files (TL-2026-0100) is a high-severity software vulnerability, first published 2026-02-16. It has no confirmed attribution, maps to 30 MITRE ATT&CK techniques (T1005, T1036, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0100
- Threat ID
- TL-2026-0100
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-02-16
- Last reviewed
- 2026-02-16
- Attribution confidence
- NONE
- Motivation
- INITIAL_ACCESS
- Target sectors
- Technology, Software Development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
GitHub Codespaces and VS Code Dev Container configuration files (.devcontainer/devcontainer.json, .vscode/) enable arbitrary code execution when users open repositories containing malicious lifecycle hooks (postCreateCommand, postStartCommand, postAttachCommand), poisoned Dockerfiles, or trojanized extension recommendations — a design-level trust model flaw exploiting developer trust in git clone operations.
How GitHub Codespaces RCE via VS Code Configuration Files works
GitHub Codespaces provides cloud-based development environments using the Dev Container specification. The devcontainer.json configuration file supports 6 lifecycle hooks that execute arbitrary shell commands at different container stages: initializeCommand (runs on host before container creation), onCreateCommand, updateContentCommand, postCreateCommand, postStartCommand, and postAttachCommand. When a developer opens a Codespace from a repository containing malicious configuration files, these commands execute automatically without explicit user consent beyond the initial Codespace creation action. The attack surface extends across three vectors: (1) Lifecycle Hook Abuse — malicious postCreateCommand/postStartCommand entries in devcontainer.json execute arbitrary shell commands during container setup. GitHub's own security documentation warns that devcontainer.json 'can contain powerful features, such as installing third-party extensions and running arbitrary code supplied in a postCreateCommand.' (2) Malicious Dockerfile Injection — the .devcontainer/Dockerfile controls the entire container image build, allowing malware installation, backdoor deployment, or credential theft during image construction. (3) VS Code Extension Supply Chain — the customizations.vscode.extensions array in devcontainer.json auto-installs extensions that run with full user privileges without any sandbox. Aqua Nautilus (2023) demonstrated that VS Code Marketplace extensions can be trivially impersonated via typosquatting and displayName spoofing — their Prettier impersonation PoC received 1,000+ installations within 48 hours. The 'verified publisher' badge only confirms domain ownership, not identity. Additionally, Trend Micro (January 2023) demonstrated that Codespaces' public port forwarding feature can be weaponized to create ephemeral malware delivery infrastructure on legitimate github.dev domains, bypassing reputation-based detection. Supply chain attack vectors include: forked repositories with modified .devcontainer/ configs, pull requests injecting devcontainer changes, template repositories distributing malicious configurations, and dependency confusion via Dev Container Features from untrusted registries. Organizational controls exist but are opt-in: GitHub provides policies for base image restriction, port visibility limitation, and machine type access — but individual developers and free accounts have no such guardrails. The fundamental trust model flaw: developers trust 'git clone' and 'Open in Codespace' as safe operations, but devcontainer.json transforms repository opening into arbitrary code execution.
MITRE ATT&CK techniques used in TL-2026-0100
collection
T1005 Data from Local System; T1213.003 Code Repositories
defense-evasion
T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1078 Valid Accounts
persistence
T1037 Boot or Logon Initialization Scripts; T1098 Account Manipulation; T1137 Office Application Startup
execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.004 Unix Shell; T1059.006 Python; T1204.001 Malicious Link; T1204.002 Malicious File
command-and-control
lateral-movement
initial-access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
impact
credential-access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.004 Private Keys
privilege-escalation
T1546 Event Triggered Execution; T1548 Abuse Elevation Control Mechanism
defense-impairment
exfiltration
T1567 Exfiltration Over Web Service
resource-development
Remediation for GitHub Codespaces RCE via VS Code Configuration Files
Immediate actions
- Audit all .devcontainer/ and .vscode/ configuration files before opening any Codespace or Dev Container from untrusted repositories
- Enable GitHub organization policies to restrict base images to approved container registries only
- Restrict port visibility to 'private only' via GitHub org Codespaces policies
- Review VS Code extensions.json recommendations before opening workspaces — verify publisher identity and extension authenticity
- Use VS Code Workspace Trust feature to restrict extension execution in untrusted workspaces
Workarounds
- Open untrusted repositories in browser-based Codespaces (more isolated than local Dev Containers) and inspect devcontainer.json before rebuilding
- Use VS Code restricted mode for untrusted folders — disables workspace settings, tasks, and extension recommendations
Longer-term hardening
- Implement mandatory code review for any PR modifying .devcontainer/ or .vscode/ configuration files
- Deploy pre-commit hooks or CI checks that flag devcontainer.json lifecycle commands for manual review
- Maintain an organization-approved allowlist of VS Code extensions and Dev Container Features
- Advocate for sandbox execution model for VS Code extensions (currently extensions run with full user privileges)
- Monitor Dev Container Feature registries for typosquatting and supply chain attacks
- Implement container image signing and verification for dev container base images
Timeline of GitHub Codespaces RCE via VS Code Configuration Files
- GitHub Codespaces enters public beta, introducing cloud-based dev containers to GitHub's 56M+ developers. Source: https://github.blog/changelog/2020-09-04-github-codespaces-public-beta/
- Microsoft open-sources the Dev Container specification, standardizing devcontainer.json with lifecycle hooks (postCreateCommand, postStartCommand, etc.) across VS Code, Codespaces, and third-party tools. Source: https://containers.dev/
- GitHub Codespaces becomes generally available and free for all users (up to 60 hours/month for free accounts), massively expanding the attack surface. 94M+ developers now have access. Source: https://github.blog/changelog/2022-11-09-codespaces-for-free-and-pro-accounts/
- Trend Micro publishes research demonstrating abuse of Codespaces port forwarding for malware delivery. Publicly forwarded ports create ephemeral malware hosting on legitimate github.dev domains. No in-the-wild exploitation observed at publication time. Source: https://www.trendmicro.com/en_us/research/23/a/abusing-github-codespaces-for-malware-delivery.html
- Aqua Nautilus publishes research on VS Code Marketplace extension impersonation. PoC Prettier impersonation received 1,000+ installations in 48 hours. Extensions run with full user privileges without sandbox. displayName spoofing trivially enables masquerading. Verified publisher badge only confirms domain ownership. Source: https://www.aquasec.com/blog/can-you-trust-your-vscode-extensions/
- GitHub provides organizational Codespaces policies: base image restriction, port visibility limitation, machine type access control, idle timeout restriction, retention period limits. All opt-in — no default enforcement for individual/free accounts. Source: https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization
- Dev Container Features ecosystem grows to hundreds of community-contributed features from registries including ghcr.io. Features execute arbitrary install scripts during container creation — supply chain risk analogous to npm/PyPI package poisoning but in the container configuration layer. Source: https://containers.dev/features
- ThreadLinqs Intelligence documents the comprehensive attack surface: 6 lifecycle hooks, Dockerfile injection, extension supply chain, port forwarding abuse, Dev Container Feature poisoning, and organizational policy gaps. Establishes DevOps Configuration-as-Code as a distinct attack surface category. Source: https://intel.threadlinqs.com/#TL-2026-0100
- As of 2026-05-29, this no-CVE design-level devcontainer.json/VS Code RCE trust-flaw remains exploitable: Orca Security (Feb 4, 2026) re-demonstrated lifecycle-hook RCE and token exfiltration, and Microsoft declared it "by design" with no patch. Stored "PATCHED" is inaccurate; only adjacent gh-CLI CVE-2024-52308 was fixed, so the surface is watch-worthy, not remediated.
Sources cited for GitHub Codespaces RCE via VS Code Configuration Files
- Trend Micro: Abusing a GitHub Codespaces Feature For Malware Delivery
- Aqua Nautilus: Can You Trust Your VSCode Extensions?
- GitHub Docs: Security in GitHub Codespaces
- GitHub Docs: Introduction to Dev Containers
- Dev Container Specification: JSON Reference
- GitHub Docs: Restricting Base Image for Codespaces
- GitHub Docs: Restricting Visibility of Forwarded Ports
- VS Code Marketplace: Dev Containers Extension (ms-vscode-remote.remote-containers)
More in vulnerability
- VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)
- Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected Imminently
- GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)
- CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE
- Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)
Detection coverage for TL-2026-0100
As of 2026-02-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0100 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.