CVE-2026-10144 web-infra-dev CVE debrief

Who should care

Defenders responsible for Rsbuild deployments on macOS systems should assess exposure and prioritize patching or mitigating this vulnerability. This includes reviewing compensating controls, monitoring usage, and verifying patching for affected systems. Security teams and vulnerability management teams should also review the vulnerability and assess the impact on their environments.

Why it matters

CVE-2026-10144 is a command injection vulnerability in Rsbuild before version 2.0.9 that allows attackers to execute arbitrary OS commands on macOS systems. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Rsbuild is used on macOS systems.

• Potential for attackers to execute arbitrary OS commands
• Possible disruption of Rsbuild functionality
• Need for defenders to verify and patch vulnerable systems
• Potential for attackers to gain elevated privileges

Technical summary

The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(). However, because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution. This vulnerability affects Rsbuild deployments on macOS systems, allowing attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Rsbuild is used on macOS systems.

Recommended defensive actions

• Patch Rsbuild to version 2.0.9 or later
• Restrict access to the server.open configuration on macOS systems
• Monitor Rsbuild usage and detect potential command injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed to exist in Rsbuild versions before 2.0.9. The openBrowser() function is vulnerable to command injection due to the use of encodeURI(), which does not encode certain shell metacharacters.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.