Fix OS command injection in openBrowser (CVE-2026-14802)

[vimalviswan]

Summary

• Fixes OS command injection in react-dev-utils/openBrowser.js on macOS (CVE-2026-14802 / SNYK-JS-REACTDEVUTILS-17890708).
• Replaces shell-interpolated execSync with execFileSync so URL arguments are never interpreted by /bin/sh (same approach as Security Fix for Command Injection #12590).
• Adds regression tests covering the AppleScript launch path and the injection payload shape from #17269.

Root cause

On Darwin, startBrowserProcess built an osascript command string and passed it through execSync. encodeURI(url) does not escape shell-significant characters ($, (, )), so a crafted URL such as http://localhost/$(touch$IFS/tmp/...) could execute arbitrary commands when Chrome was already running.

Fix

execFileSync(
  'osascript',
  ['openChrome.applescript', encodeURI(url), chromiumBrowser],
  { cwd: __dirname, stdio: 'ignore' }
);

Test plan

• npm test -- --testPathPattern=openBrowser in packages/react-dev-utils (4 passing)
• On macOS with Chrome running, confirm openBrowser('http://localhost:3000') still reuses an existing tab
• Confirm a URL containing $(...) / $IFS does not create side effects on disk when opened via the AppleScript path

Closes #17269

[meta-cla]

Hi @vimalviswan!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!