{"id":"CVE-2026-10144","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-10144","summary":"Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to…","details":"Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.","published":"2026-09-15T22:16:55.387","modified":"2026-09-15T22:16:55.387","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/web-infra-dev/rsbuild/commit/c1e2aebd6b1bbdaece15265572c3284f934b674d","label":"web-infra-dev/rsbuild@c1e2aeb"},"references":[{"type":"WEB","url":"https://github.com/web-infra-dev/rsbuild/commit/c1e2aebd6b1bbdaece15265572c3284f934b674d"},{"type":"WEB","url":"https://github.com/web-infra-dev/rsbuild/pull/7789"},{"type":"WEB","url":"https://github.com/web-infra-dev/rsbuild/releases/tag/v2.0.9"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/rsbuild-command-injection-via-openbrowser-url-handling"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T22:16:55.387"}}