CVE-2026-10144
Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.
| CWE | CWE-78 |
| Vendor | web-infra-dev |
| Product | rsbuild |
| Published | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for web-infra-dev rsbuild
Be the first to know when new high vulnerabilities affecting web-infra-dev rsbuild are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
web-infra-dev / rsbuild
0 < 2.0.9
References
github.com: https://github.com/web-infra-dev/rsbuild/releases/tag/v2.0.9 github.com: https://github.com/web-infra-dev/rsbuild/pull/7789 github.com: https://github.com/web-infra-dev/rsbuild/commit/c1e2aebd6b1bbdaece15265572c3284f934b674d vulncheck.com: https://www.vulncheck.com/advisories/rsbuild-command-injection-via-openbrowser-url-handling
Credits
Katriel Moses VulnCheck