Is CVE-2026-10144 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-10144?

CVE-2026-10144 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-10144

Description

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.