DRAG AND PWND: LEVERAGE ASCII CHARACTERS TO EXPLOIT VS CODE

Summary from the TLDR InfoSec newsletter

Zakhar Fedotkin found that ASCII control characters such as SOH (\x01) and ETX (\x03) can be exploited in Visual Studio Code to run arbitrary commands via node-pty, which sends raw bytes to the shell. The vulnerability exploits two vectors: injecting control characters into run configuration files and creating maliciously named files that execute commands when dragged into VS Code's terminal. This issue impacts macOS and Ubuntu systems, where control characters are permitted in filenames, although Microsoft does not view it as a security vulnerability due to measures like workspace trust warnings.