TI-2026-08888 Aliases CVE-2026-10144 GHSA-x8vr-98rv-c92v

Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling

LOW 37CWE-78Published 2026-09-15 · Updated 2026-09-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0168 77th percentileScored 2026-11-07

Fix Fixed rsbuild (web-infra-dev): 2.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
web-infra-dev	rsbuild	before 2.0.9	2.0.9	Patch available	CNA

rsbuild Vendorweb-infra-dev Affected before 2.0.9 Fixed in 2.0.9 Patch available CNA

Remediation

Fix · CNA rsbuild (web-infra-dev) Fixed in 2.0.9

Timeline

2026-10-02 Threatist record created from CVE-2026-10144
2026-10-03 Alias added: GHSA-x8vr-98rv-c92v

References

Patch 2

Other 1

Rsbuild v2.0.9 Release Notes

TI-2026-44225 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata CVSS 3.1HIGH 7.5
TI-2026-42625 Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket CVSS 4.0HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences