Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

ruby-lsp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1RubyGemsPublished

    Ruby LSP has arbitrary code execution through branch setting

    CVE-2026-34060 · GHSA-c4r5-fxqw-vh93

    Affected
    • RubyGems ruby-lsp < 0.26.9
    Fixed in
    0.26.9· Vendor fix available
    Issue
    The rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. Other editors that support workspace setting that get automatically applied upon opening the editor and trusting the workspace are also impacted since the server is the component that performs the interpolation. Details The branch CLI argument passed to the ruby-lsp server was interpolated in the generated .ruby-lsp/Gemfile without sanitization. Editors that allow defining settings saved at the workspace level (e.g.: .vscode/settings.json) that gets automatically applied open the possibility to craft a malicious repository that once opened and trusted in the editor would run arbitrary code. Impact Code execution with the privileges of the user who opens the malicious project. Ruby LSP assumes workspace code is trusted and so opening the editor on an…

    Recommended action: Upgrade to 0.26.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →