CVE-2026-10144

Deferred Deferred - Pending Action

Rsbuild Command Injection via Malicious URL on macOS

Publication date: 2026-09-15

Last updated on: 2026-09-23

Assigner: VulnCheck

Description

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-23

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-10144

EUVD

EUVD-2026-80006

Affected Vendors & Products

Vendor	Product	Version / Range
rsbuild	rsbuild	to 2.0.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Rsbuild before version 2.0.9 has a command injection flaw. The openBrowser() function in packages/core/src/server/open.ts uses encodeURI() on a URL before passing it to a shell command via child_process.exec(). However, encodeURI() fails to encode certain shell metacharacters like dollar signs, parentheses, and semicolons, allowing attackers to embed malicious commands that execute arbitrary OS commands on macOS systems.

Detection Guidance

Check Rsbuild version with npm list rsbuild or grep rsbuild package.json. If version is below 2.0.9, the system is vulnerable. Inspect server.open configuration for openBrowser() usage and verify URL handling in packages/core/src/server/open.ts.

Impact Analysis

This vulnerability allows attackers to run arbitrary commands on your system if you are using Rsbuild before 2.0.9 on macOS. An attacker could exploit this to install malware, steal data, or take control of your machine by tricking you into visiting a specially crafted URL.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using vulnerable versions may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Rsbuild to version 2.0.9 or higher immediately. Review and sanitize all URLs passed to openBrowser() to remove shell metacharacters. Disable or restrict server.open configuration if not required.

Hi! I’m here to help you understand CVE-2026-10144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70