Read the docs
TI-2026-35561 Aliases CVE-2026-48122

Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

Priority LOW 26CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed ruby-lsp (Shopify): 0.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
remix-runruby-lspbefore 0.10.40.10.4Patch availableCNA
  • ruby-lsp Vendorremix-run Affected before 0.10.4 Fixed in 0.10.4 Patch available CNA

Remediation

  • Fix · CNA ruby-lsp (Shopify) Fixed in 0.10.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48122

References

Other 1

  • TI-2025-28449 React Router allows pre-render data spoofing on React-Router framework mode CVSS 3.1HIGH 8.2
  • TI-2025-28448 React Router allows a DoS via cache poisoning by forcing SPA mode CVSS 3.1HIGH 7.5
  • TI-2025-38117 React Router has Path Traversal in File Session Storage CVSS 3.1CRITICAL 9.1
  • TI-2026-40200 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVSS 4.0HIGH 8.7
  • TI-2025-33550 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVSS 4.0HIGH 8.1
  • TI-2026-26385 Ruby LSP has arbitrary code execution through branch setting CVSS 4.0HIGH 7.1
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences