Rsbuild versions prior to 2.0.9 include a command injection flaw that allows an attacker to execute arbitrary operating system commands on macOS by providing a specially crafted URL to the server.open configuration. The openBrowser() routine passes the URL through encodeURI() before embedding it into a shell command that is executed with child_process.exec(). Because encodeURI() does not escape characters such as dollar signs, parentheses or semicolons, these shell metacharacters are interpreted by /bin/sh, giving the attacker the ability to run with CWE‑78 – System Command Injection.

Affected vendor and product is Rsbuild from the web‑infra‑dev group. The vulnerability exists in all releases before 2.0.9, i.e., Rsbuild 1.x and 2.0.0 through 2.0.8. Precise version ranges are confirmed by the advisory commit and release notes available on GitHub.

The CVSS score is 7.1, indicating a high level of severity. The EPSS score of 2 % suggests a moderate likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to inject a crafted URL into the server.open configuration, which is typically achievable by a developer or a local attacker with access to the development environment. Once injected, the attacker can run arbitrary shell commands with the privileges of the user running the Rsbuild process.