CVE-2026-34060highCWE-94

CVE-2026-34060: falha de alta gravidade em Shopify.ruby-lsp

Ruby LSP has arbitrary code execution through branch setting

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ruby-lsp+ Monitorar Shopify.ruby-lsp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Shopify · ruby-lspShopify · Shopify.ruby-lsp
CVEs relacionadas — Shopify.ruby-lsp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-48122MEDIUMWorkspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extensionEPSS 0.2%