HarborGuard / CVE
Back to search
CRITICALCVE-2026-34060Published Modified CNA GitHub_M

CVE-2026-34060: Ruby LSP has arbitrary code execution through branch setting

Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.

Metrics

CVSS v3.1
9.8
Severity
CRITICAL
Fixed in
—
Affected Products
2
Affected packages
  • Shopify / ruby-lsp
    < 0.26.9
  • Shopify / Shopify.ruby-lsp
    < 0.10.2
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References