Read the docs
TI-2026-26385 Aliases CVE-2026-34060GHSA-c4r5-fxqw-vh93

Ruby LSP has arbitrary code execution through branch setting

Priority MEDIUM 40CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix Fixed ruby-lsp (Shopify): 0.26.9Shopify.ruby-lsp (Shopify): 0.10.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
remix-runruby-lspbefore 0.26.90.26.9Patch availableCNA
remix-runShopify.ruby-lspbefore 0.10.20.10.2Patch availableCNA
—ruby-lsp (RubyGems)before 0.26.90.26.9Patch availableGHSA-c4r5-fxqw-vh93
  • ruby-lsp Vendorremix-run Affected before 0.26.9 Fixed in 0.26.9 Patch available CNA
  • Shopify.ruby-lsp Vendorremix-run Affected before 0.10.2 Fixed in 0.10.2 Patch available CNA
  • ruby-lsp (RubyGems) Vendor— Affected before 0.26.9 Fixed in 0.26.9 Patch available GHSA-c4r5-fxqw-vh93

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:shopify:ruby_lsp:*:*:*:*:*:visual_studio_code:*:*before 0.10.2Vulnerableremix-run
cpe:2.3:a:shopify:ruby_lsp:*:*:*:*:*:ruby:*:*before 0.26.9Vulnerableremix-run
  • cpe:2.3:a:shopify:ruby_lsp:*:*:*:*:*:visual_studio_code:*:* Versions before 0.10.2 Vulnerable ·remix-run
  • cpe:2.3:a:shopify:ruby_lsp:*:*:*:*:*:ruby:*:* Versions before 0.26.9 Vulnerable ·remix-run

Remediation

  • Fix · CNA ruby-lsp (Shopify) Fixed in 0.26.9
  • Fix · CNA Shopify.ruby-lsp (Shopify) Fixed in 0.10.2
  • Fix · GHSA-c4r5-fxqw-vh93 ruby-lsp (RubyGems) Fixed in 0.26.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34060
  2. 2026-10-03 Alias added: GHSA-c4r5-fxqw-vh93

References

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences