PT-2026-28598 · Microsoft+1 · Vscode+1

Vinistock · Publicado 2026-03-27 · Atualizado 2026-06-03 · CVE-2026-34060

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ruby-lsp versions prior to 0.10.2 ruby-lsp gem versions prior to 0.26.9

Description The rubyLsp.branch VS Code workspace setting was used in generating a Gemfile without proper sanitization, potentially allowing arbitrary Ruby code execution when opening a project with a malicious .vscode/settings.json. This impacts editors that automatically apply workspace settings upon opening and trusting the workspace. Ruby LSP operates under the assumption that workspace code is trusted, and opening an untrusted workspace could lead to the execution of dangerous code. The branch CLI argument and setting have been removed to address this.

Recommendations Update to ruby-lsp extension version 0.10.2 or later. Update the ruby-lsp gem to version 0.26.9 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-34060

GHSA-C4R5-FXQW-VH93

Produtos afetados

Vscode

Ruby-Lsp

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34060.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-lsp/CVE-2026-34060.yml · Exploit
• https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93 · Aviso do Fabricante
• https://github.com/Shopify/ruby-lsp · Nota
• https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9 · Nota
• https://twitter.com/CVEnew/status/2038916037899673816 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34060 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c4r5-fxqw-vh93 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1s6lazl/resumen_diario_de_vulnerabilidades_29032026 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2026-34060 · Aviso do Fabricante
• https://t.me/cveNotify/165751 · Publicação no Telegram
• https://twitter.com/rubylandnews/status/2038652523188219945 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-34060 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34060 · Nota de Segurança
• https://twitter.com/CVEarity/status/2038956481337590167 · Publicação no Twitter