CVE-2026-10144: Rsbuild Command Injection RCE Vulnerability

CVE-2026-10144 Overview

Rsbuild versions before 2.0.9 contain a command injection vulnerability [CWE-78] in the openBrowser() function within packages/core/src/server/open.ts. On macOS, a crafted URL supplied to the server.open configuration is passed through encodeURI() and interpolated into a shell command executed via child_process.exec(). Because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters reach /bin/sh and execute as arbitrary commands. Exploitation requires local access and user action, but yields high impact to confidentiality, integrity, and availability.

Critical Impact
Attackers can execute arbitrary operating system commands in the context of the developer running Rsbuild on macOS by controlling the server.open URL.

Affected Products

Rsbuild versions prior to 2.0.9
@rsbuild/core package on macOS development environments
Downstream projects that pass untrusted input into the server.open configuration

Discovery Timeline

2026-09-15 - CVE-2026-10144 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-10144

Vulnerability Analysis

Rsbuild is a build tool built on Rspack that provides a development server capable of opening the default browser to a specified URL. The openBrowser() helper in packages/core/src/server/open.ts constructs a shell command that launches the browser and passes the target URL as an argument.

The function sanitizes the URL using JavaScript's built-in encodeURI() before concatenating it into the command string. However, encodeURI() intentionally preserves characters that are legal in URIs, including $, (, ), and ;. These characters carry syntactic meaning inside /bin/sh, so a URL such as http://localhost/$(id) results in command substitution when child_process.exec() spawns the shell.

The impact is limited to hosts where the developer runs the vulnerable version and where an attacker can influence the URL opened by the dev server. Successful exploitation runs code with the privileges of the user executing Rsbuild.

Root Cause

The root cause is trusting encodeURI() as a shell-escaping primitive. URI encoding and shell quoting solve different problems. Using child_process.exec() compounds the issue by invoking a shell interpreter that evaluates metacharacters instead of treating the URL as a single argument.

Attack Vector

An attacker supplies a URL containing shell metacharacters that reaches the server.open configuration. This can occur through project configuration files, environment variables, command-line arguments, or template scaffolding controlled by the attacker. When the developer starts the dev server on macOS, openBrowser() executes the crafted command.

typescript

// Security patch in packages/core/src/server/open.ts
// fix(core): avoid shell interpolation in browser opener (#7789)

   // a Chromium browser with AppleScript. This lets us reuse an
   // existing tab when possible instead of creating a new one.
   if (shouldTryAppleScript(browser, browserArgs)) {
-    const { exec } = await import('node:child_process');
+    const { execFile } = await import('node:child_process');
     const { promisify } = await import('node:util');
-    const execAsync = promisify(exec);
+    const execFileAsync = promisify(execFile);

     /**
      * Find the browser that is currently running
      */
     const getDefaultBrowserForAppleScript = async () => {
-      const { stdout: ps } = await execAsync('ps cax');
+      const { stdout: ps } = await execFileAsync('ps', ['cax']);
       return supportedChromiumBrowsers.find((b) => ps.includes(b));
     };

Source: GitHub Commit c1e2aeb. The fix replaces exec() with execFile(), which passes arguments directly to the target binary and avoids shell interpretation.

Detection Methods for CVE-2026-10144

Indicators of Compromise

Unexpected child processes spawned by node under a developer session running Rsbuild, particularly /bin/sh -c invocations containing URL fragments
Shell command lines that include $(...), backticks, or semicolons alongside http:// or https:// arguments
macOS open or AppleScript osascript executions launched with unusual arguments during dev server startup

Detection Strategies

Inventory JavaScript projects that depend on @rsbuild/core at versions below 2.0.9 using software composition analysis or npm ls @rsbuild/core
Alert on process trees where node spawns /bin/sh with command strings containing shell metacharacters adjacent to URLs
Review project configuration and CI pipelines for server.open values sourced from untrusted input

Monitoring Recommendations

Collect endpoint process telemetry from developer macOS systems and hunt for anomalous descendants of Rsbuild dev server processes
Monitor package manifests and lockfiles in source control for outdated Rsbuild versions
Track outbound network connections initiated by shells spawned from Node.js during local development

How to Mitigate CVE-2026-10144

Immediate Actions Required

Upgrade @rsbuild/core to version 2.0.9 or later across all projects and CI images
Audit rsbuild.config.* files and any code that assigns to server.open for untrusted URL sources
Rotate credentials or tokens accessible from developer workstations if unexplained process activity is observed

Patch Information

The fix is included in Rsbuild v2.0.9 via Pull Request #7789. The maintainers replaced child_process.exec() with child_process.execFile() in packages/core/src/server/open.ts, eliminating shell interpretation of URL arguments. See the VulnCheck Security Advisory for additional context.

Workarounds

Disable automatic browser opening by setting server.open to false until the upgrade is applied
Restrict server.open to hardcoded, trusted URLs and never populate it from environment variables or CLI input
Avoid running the Rsbuild dev server against projects from untrusted sources on macOS

bash

# Upgrade Rsbuild to the patched release
npm install @rsbuild/core@^2.0.9

# Verify the installed version
npm ls @rsbuild/core

# Temporary workaround: disable auto-open in rsbuild.config.ts
# export default defineConfig({
#   server: {
#     open: false,
#   },
# });