Skip to content
Drag and Pwnd: Leverage ASCII characters to exploit VS Code
portswigger.net | research | #command-injection | #terminal | #vs-code | #control-characters | #node-pty | #ascii
Summary
Control characters like SOH and carriage return, forwarded blindly by node-pty, enable command injection through VS Code run configurations and filenames dropped into terminals on macOS and Ubuntu.
- Published
- Collected