CVE-2026-48122

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-2x7g-8mp4-572w

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Ruby LSP es una implementación del protocolo del servidor de lenguaje para Ruby. Varias configuraciones a nivel de espacio de trabajo en la extensión Ruby LSP de VS Code anteriores a la versión 0.10.4 podrían anular la ruta al ejecutable de Ruby, los ejecutables del gestor de versiones o el ’Gemfile’ de Bundler utilizado al inicio. Un repositorio malicioso que contuviera un ’.vscode/settings.json’ podría establecer estos valores a objetivos controlados por el atacante. Abrir y confiar en el repositorio ejecutaría entonces código con los privilegios del desarrollador. El gem de Ruby LSP y los clientes del servidor de lenguaje en otros editores no se ven afectados. La versión 0.10.4 de la extensión Ruby LSP de VS Code corrige el problema.

Information

Published : 2026-08-07 23:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-48122

Mitre link : CVE-2026-48122

CVE.ORG link : CVE-2026-48122

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-48122", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48122", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T22:09:35.098666Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Shopify", "product": "ruby-lsp", "versions": [{"status": "affected", "version": "< 0.10.4"}]}]}], "published": "2026-08-07T23:17:04.287", "references": [{"url": "https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-2x7g-8mp4-572w", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue."}, {"lang": "es", "value": "Ruby LSP es una implementaci\u00f3n del protocolo del servidor de lenguaje para Ruby. Varias configuraciones a nivel de espacio de trabajo en la extensi\u00f3n Ruby LSP de VS Code anteriores a la versi\u00f3n 0.10.4 podr\u00edan anular la ruta al ejecutable de Ruby, los ejecutables del gestor de versiones o el \u2019Gemfile\u2019 de Bundler utilizado al inicio. Un repositorio malicioso que contuviera un \u2019.vscode/settings.json\u2019 podr\u00eda establecer estos valores a objetivos controlados por el atacante. Abrir y confiar en el repositorio ejecutar\u00eda entonces c\u00f3digo con los privilegios del desarrollador. El gem de Ruby LSP y los clientes del servidor de lenguaje en otros editores no se ven afectados. La versi\u00f3n 0.10.4 de la extensi\u00f3n Ruby LSP de VS Code corrige el problema."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "security-advisories@github.com"}