Executive brief
Rsbuild is a JavaScript build tool used by developers to bundle and serve web applications during development. The server.open configuration feature on macOS automatically opens a browser to view the application, but was vulnerable to command injection when processing URLs containing special characters. An attacker who can control the URL passed to this feature could execute arbitrary OS commands with the privileges of the developer running the build tool.
Technical details
The vulnerability is a command injection flaw in the openBrowser() function (packages/core/src/server/open.ts) on macOS. The function encodes a URL using encodeURI() and then interpolates it into a shell command executed via child_process.exec(). However, encodeURI() does not encode dollar signs ($), parentheses, or semicolons, allowing embedded shell metacharacters to be evaluated by /bin/sh. An attacker controlling the URL in the server.open configuration or input can inject shell commands that are executed with the privileges of the build process. The fix, merged on May 30, 2026, replaces the shell invocation with an argument array passed to osascript, preventing shell interpolation entirely. Patches are available in Rsbuild 2.0.9 and later.
Affected products
- web-infra-dev Rsbuild before 2.0.9
Timeline
- 2026-09-15: advisory: CVE-2026-10144 published
- 2026-05-30: patched: Security fix merged in pull request #7789 to avoid shell interpolation in browser opener