PT-2026-28598 · Ruby-Lsp+1 · Ruby-Lsp+1

Vinistock · Published 2026-03-27 · Updated 2026-03-31 · CVE-2026-34060

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ruby-lsp versions prior to 0.10.2 ruby-lsp gem versions prior to 0.26.9

Description The rubyLsp.branch VS Code workspace setting was used in generating a Gemfile without proper sanitization, potentially allowing arbitrary Ruby code execution when opening a project with a malicious .vscode/settings.json. This impacts editors that automatically apply workspace settings upon opening and trusting the workspace. Ruby LSP operates under the assumption that workspace code is trusted, and opening an untrusted workspace could lead to the execution of dangerous code. The branch CLI argument and setting have been removed to address this.

Recommendations Update to ruby-lsp extension version 0.10.2 or later. Update the ruby-lsp gem to version 0.26.9 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-34060

GHSA-C4R5-FXQW-VH93

Affected Products

Vscode

Ruby-Lsp

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34060.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-lsp/CVE-2026-34060.yml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-34060 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c4r5-fxqw-vh93 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34060 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34060 · Vendor Advisory
• https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9 · Note
• https://github.com/Shopify/ruby-lsp · Note
• https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93 · Note
• https://twitter.com/CVEarity/status/2038956481337590167 · Twitter Post
• https://twitter.com/rubylandnews/status/2038652523188219945 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s6lazl/resumen_diario_de_vulnerabilidades_29032026 · Reddit Post
• https://twitter.com/CVEnew/status/2038916037899673816 · Twitter Post