Drag and Pwnd: Leverage ASCII characters to exploit VS Code
Summary: PortSwigger researcher Zak Fedotkin found that inserting an ASCII SOH control character (\x01) into Visual Studio Code run-configuration arguments causes the shell to split and misinterpret them, launching Calculator on macOS and Ubuntu instead of the intended script. The same flaw applies to filenames passed through node-pty, and a dragged-and-dropped file's carriage return (\x0d) executes a command automatically, which Fedotkin reproduced on macOS and Ubuntu; Microsoft Security Response Center declined to treat it as a security issue, citing workspace trust warnings and required user interaction.
Bottom line: Microsoft's dismissal rests on user interaction, yet the drag-and-drop path removes the user's chance to inspect the payload because the carriage return fires the command before the terminal shows it. Any application that passes raw bytes into a terminal without sanitizing control characters carries the same exposure, regardless of language or runtime.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026