Critical severity9.8NVD Advisory· Published Mar 31, 2026· Updated Jun 3, 2026
CVE-2026-34060
CVE-2026-34060
Description
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ruby-lspRubyGems | < 0.26.9 | 0.26.9 |
Affected products
4Patches
Vulnerability mechanics
References
5- github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93nvdVendor AdvisoryMitigationWEB
- github.com/advisories/GHSA-c4r5-fxqw-vh93ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-34060ghsaADVISORY
- github.com/Shopify/ruby-lsp/releases/tag/v0.26.9nvdRelease NotesWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-lsp/CVE-2026-34060.ymlghsaWEB
News mentions
0No linked articles in our index yet.