Web-infra-dev vulnerabilities
We track 2 vulnerabilities in Web-infra-dev products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.
2vulnerabilities
0critical
2high
0exploited
7.7average CVSS score
Latest Web-infra-dev vulnerabilities
- 7.5 High severity
rsdoctor: Exposure of Sensitive Information to an Unauthorized Actor
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint w
- 7.8 High severity
rsbuild: Improper Neutralization of Special Elements used in an OS Command
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/