Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M
CVE-2026-48122Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
Medium 5.4
In plain English
A medium-severity OS command injection in ruby-lsp from Shopify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:26.10 | ruby-ruby-lsp | no fix listed | UBUNTU-CVE-2026-48122 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-2x7g-8mp4-572w x_refsource_CONFIRM