CVE-2026-10144 Details
Description
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.
A command injection vulnerability has been identified in Rsbuild versions prior to 2.0.9. This vulnerability allows attackers to execute arbitrary operating system commands by sending a crafted URL with shell metacharacters to the server.open configuration on macOS. The issue arises in the openBrowser() function, which improperly sanitizes the URL before incorporating it into a shell command executed via child_process.exec(). The lack of proper encoding for certain characters allows embedded metacharacters to be interpreted by the shell, facilitating unauthorized command execution.
Users can upgrade to Rsbuild version 2.0.9 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/web-infra-dev/rsbuild/commit/c1e2aebd6b1bbdaece15265572c3284f934b674d | [email protected] | Source CodeVendor |
| https://github.com/web-infra-dev/rsbuild/pull/7789 | [email protected] | Issue TrackingVendor |
| https://github.com/web-infra-dev/rsbuild/releases/tag/v2.0.9 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/rsbuild-command-injection-via-openbrowser-url-handling | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| web-infra-dev rsbuild | < 2.0.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |