CVE-2026-34060

Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9	Release Notes
https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:shopify:ruby_lsp::::::visual_studio_code::*
	cpe:2.3:a:shopify:ruby_lsp::::::ruby::*

History

No history.

Information

Published : 2026-03-31 03:15

Updated : 2026-06-17 10:38

NVD link : CVE-2026-34060

Mitre link : CVE-2026-34060

CVE.ORG link : CVE-2026-34060

JSON object : View

Products Affected

shopify

ruby_lsp

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-34060", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34060", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:51:08.644486Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Shopify", "product": "ruby-lsp", "versions": [{"status": "affected", "version": "< 0.26.9"}]}, {"vendor": "Shopify", "product": "Shopify.ruby-lsp", "versions": [{"status": "affected", "version": "< 0.10.2"}]}]}], "published": "2026-03-31T03:15:58.773", "references": [{"url": "https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9."}, {"lang": "es", "value": "Ruby LSP es una implementaci\u00f3n del protocolo del servidor de lenguaje para Ruby. Antes de Shopify.ruby-lsp versi\u00f3n 0.10.2 y ruby-lsp versi\u00f3n 0.26.9, la configuraci\u00f3n del espacio de trabajo de VS Code rubyLsp.branch se interpolaba sin sanitizaci\u00f3n en un Gemfile generado, permitiendo la ejecuci\u00f3n arbitraria de c\u00f3digo Ruby cuando un usuario abre un proyecto que contiene un archivo .vscode/settings.json malicioso. Este problema ha sido parcheado en Shopify.ruby-lsp versi\u00f3n 0.10.2 y ruby-lsp versi\u00f3n 0.26.9."}], "lastModified": "2026-06-17T10:38:29.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopify:ruby_lsp:*:*:*:*:*:visual_studio_code:*:*", "vulnerable": true, "matchCriteriaId": "B9DF1FAE-0918-405B-BDE1-73D76117A796", "versionEndExcluding": "0.10.2"}, {"criteria": "cpe:2.3:a:shopify:ruby_lsp:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "3080798E-AA81-44B6-8770-D43FA84C22D8", "versionEndExcluding": "0.26.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}