Command Injection Vulnerability in Rsbuild by Web Infra Dev

CVE-2026-10144

What is CVE-2026-10144?

Rsbuild before version 2.0.9 is susceptible to a command injection flaw that allows attackers to execute arbitrary operating system commands. This vulnerability arises from the mishandling of user-supplied URLs containing shell metacharacters in the openBrowser() function, which is used for opening links on macOS. When these URLs are processed through encodeURI(), certain characters such as dollar signs, parentheses, and semicolons are not properly encoded, enabling malicious input to be executed by the shell. This can lead to severe security implications if exploited.

References