Shopify ruby-lsp

• CVE-2026-48122 Medium 5.4 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension 0.2%
• CVE-2026-34060 Critical 9.8 Ruby LSP has arbitrary code execution through branch setting 0.5%