# Drag and Pwnd: Leverage ASCII characters to exploit VS Code

DevFeed: [Drag and Pwnd: Leverage ASCII characters to exploit VS Code](<https://devfeed.tech/articles/drag-and-pwnd-leverage-ascii-characters-to-exploit-vs-code-7676.md>)

Original publisher: [Read original article](<https://portswigger.net/research/drag-and-pwnd-leverage-ascii-characters-to-exploit-vs-code>)

Author: Zakhar Fedotkin

Published: 2025-04-30T12:37:11Z

Content type: tutorial

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [ascii](<https://devfeed.tech/tags/ascii.md>), [bash](<https://devfeed.tech/tags/bash.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [vs-code](<https://devfeed.tech/tags/vs-code.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article explains how ASCII control characters can be abused through VS Code terminal handling to cause command injection behavior.

## Source excerpt

Control characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics