CVE-2026-10144

Name of the Vulnerable Software and Affected Versions Rsbuild versions prior to 2.0.9

Description On macOS, a command injection issue exists when a crafted URL containing shell metacharacters is supplied to the server.open configuration. The openBrowser() function in packages/core/src/server/open.ts processes the URL using encodeURI() before interpolating it into a shell command executed via child process.exec(). Since encodeURI() does not encode semicolons, parentheses, or dollar signs, these metacharacters are evaluated by /bin/sh, allowing the execution of arbitrary OS commands.

Recommendations Update to version 2.0.9 or later.