---
id: 5042
title: "Drag and Pwnd: Leverage ASCII characters to exploit VS Code"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/drag-and-pwnd-leverage-ascii-characters-to-exploit-vs-code"
published_at: "2025-05-01 12:27"
tags: ["command-injection", "terminal", "vs-code", "control-characters", "node-pty", "ascii"]
phying_url: "https://phying.com/item/5042"
lang: en
---

# Drag and Pwnd: Leverage ASCII characters to exploit VS Code

## Summary

Control characters like SOH and carriage return, forwarded blindly by node-pty, enable command injection through VS Code run configurations and filenames dropped into terminals on macOS and Ubuntu.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-05-01 12:27
- **Original:** https://portswigger.net/research/drag-and-pwnd-leverage-ascii-characters-to-exploit-vs-code
- **Phying News:** https://phying.com/item/5042