Skip to content
OpenAdvisories

Vendor

web-infra-dev

3 known vulnerabilities.

Products

midscene 1 rsbuild 1 rsdoctor 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-61782

    @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

    Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint …

    web-infra-dev rsdoctor @rsdoctor/rspack-plugin npm
  • High 7.8
    CVE-2026-10144

    Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling

    Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages…

    web-infra-dev rsbuild