CVE-2026-10144

Rsbuild prior to 2.0.9 contains an OS command injection flaw (CWE-78) in the dev server's browser-opening routine on macOS. When a developer starts the dev server with the server.open configuration set to a crafted URL containing shell metacharacters, the openBrowser() function in packages/core/src/server/open.ts only sanitizes the URL with encodeURI(), which leaves dollar signs, parentheses, and semicolons intact; the URL is then interpolated into a command run through child_process.exec(), so /bin/sh evaluates the injected metacharacters. Successful exploitation executes arbitrary OS commands with the developer's privileges on their Mac, with high impact on local confidentiality, integrity, and availability. The realistic attack path is user-interaction-driven: a malicious or cloned repository or shared config that hard-codes a server.open URL, which is executed when the victim runs the dev server (reflected in the CVSS 4.0 vector: local attack vector, no privileges required, user interaction required, 7.1 high). There is no known public PoC, no known in-the-wild exploitation, and the CVE is not on the CISA KEV list.

What to do: Upgrade @rsbuild/core (and related Rsbuild packages) to version 2.0.9 or later. Audit any rsbuild.config.* files — especially from cloned repositories, templates, or shared configs — for a custom server.open URL containing shell metacharacters such as $, (, ), or ;, and treat untrusted project configs as untrusted code. macOS developers who ran suspect configs should check for signs of unexpected command execution (shell history, unknown processes, modified dotfiles).