CVE-2026-10144: Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via childprocess.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rsbuildto a version that resolves this vulnerability.Fixed in 2.0.9 - Configuration
Patch the openBrowser() URL handling so that dollar signs, parentheses, and semicolons are encoded (encodeURI() is insufficient because it does not encode these characters) to prevent command injection through the /bin/sh command string.
Rsbuild (packages/core/src/server/open.ts) openBrowser()/server.open on macOS URL encoding for shell interpolation = Use encoding that also encodes shell metacharacters ($, (, ), ;) before passing to child_process.exec()
Event History
Frequently Asked Questions
Which environments are exposed?
The described vulnerable path is on macOS. It affects Rsbuild versions before 2.0.9 when a crafted URL is supplied through the server.open configuration.
What does an attacker need to exploit this?
An attacker needs a way to cause a crafted URL containing shell metacharacters to be used in server.open. User interaction is required according to the supplied CVSS vector.
What is the recommended remediation?
Upgrade Rsbuild to version 2.0.9 or later. The issue is fixed in the 2.0.9 release.