CVE-2026-34060: Ruby LSP RCE Vulnerability

CVE-2026-34060 Overview

CVE-2026-34060 is a code injection vulnerability in Ruby LSP, an implementation of the language server protocol for Ruby. The vulnerability exists because the rubyLsp.branch VS Code workspace setting was interpolated without proper sanitization into a generated Gemfile. This allows attackers to achieve arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json file.

Critical Impact
Arbitrary Ruby code execution when opening malicious projects in VS Code with Ruby LSP extension installed

Affected Products

Shopify.ruby-lsp versions prior to 0.10.2
ruby-lsp versions prior to 0.26.9
VS Code installations with vulnerable Ruby LSP extension

Discovery Timeline

March 31, 2026 - CVE-2026-34060 published to NVD
April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34060

Vulnerability Analysis

This vulnerability (CWE-94: Improper Control of Generation of Code) arises from insufficient input sanitization in the Ruby LSP extension's handling of workspace settings. When a developer opens a VS Code project, the extension reads configuration from .vscode/settings.json and uses the rubyLsp.branch setting value directly when generating a Gemfile for the project's language server environment.

The lack of sanitization means that specially crafted values in the branch setting can break out of the intended string context and inject arbitrary Ruby code. This code executes with the same privileges as the developer's user account when the Gemfile is processed by Bundler.

Root Cause

The root cause is improper input validation when interpolating user-controlled workspace settings into dynamically generated Ruby code. The rubyLsp.branch setting value was directly embedded into the generated Gemfile without escaping or validating the input, creating a code injection vulnerability. Any malicious content in this setting would be interpreted as Ruby code during Gemfile evaluation.

Attack Vector

The attack requires local access and user interaction. An attacker must convince a victim to open a malicious project (e.g., by cloning a repository containing a crafted .vscode/settings.json file). When the victim opens this project in VS Code with the vulnerable Ruby LSP extension installed, the malicious code embedded in the workspace settings executes automatically.

This attack vector is particularly concerning for developers who frequently clone and review external repositories, as simply opening a project triggers the vulnerability without any additional user action beyond the initial project opening.

The vulnerability mechanism works as follows: The malicious .vscode/settings.json file contains a crafted rubyLsp.branch value with embedded Ruby code. When Ruby LSP generates the internal Gemfile, this value is interpolated without sanitization. Bundler then evaluates this Gemfile, executing the injected code with the developer's privileges. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-34060

Indicators of Compromise

Suspicious .vscode/settings.json files in cloned repositories containing unusual rubyLsp.branch values
Unexpected process execution originating from VS Code or Ruby LSP processes
Anomalous network connections initiated during project opening in VS Code
Presence of unfamiliar Ruby code in generated Gemfiles within the Ruby LSP cache directories

Detection Strategies

Monitor file system activity for creation or modification of .vscode/settings.json files with suspicious content patterns
Implement code review processes for .vscode/ directories in external repositories before opening projects
Deploy endpoint detection to identify Ruby process spawning unexpected child processes during VS Code usage
Use SentinelOne's behavioral AI to detect anomalous code execution patterns originating from development tools

Monitoring Recommendations

Enable logging for VS Code extension activities and Ruby LSP operations
Monitor for unexpected outbound network connections from development environments
Track process genealogy to identify suspicious child processes spawned by VS Code or Bundler
Implement alerting for attempts to modify or access sensitive files from Ruby processes

How to Mitigate CVE-2026-34060

Immediate Actions Required

Update Shopify.ruby-lsp extension to version 0.10.2 or later
Update ruby-lsp gem to version 0.26.9 or later
Review recently opened projects for suspicious .vscode/settings.json files
Audit development machines for signs of compromise if unknown repositories were recently opened

Patch Information

Shopify has released patched versions that properly sanitize the rubyLsp.branch setting before interpolation. Users should update to Shopify.ruby-lsp version 0.10.2 or ruby-lsp version 0.26.9. The fix ensures that workspace settings are properly escaped before being included in generated Gemfiles, preventing code injection attacks.

For more information, see the GitHub Release v0.26.9 and the GitHub Security Advisory GHSA-c4r5-fxqw-vh93.

Workarounds

Temporarily disable the Ruby LSP extension until updates can be applied
Manually inspect .vscode/settings.json files in repositories before opening projects
Remove or reset the rubyLsp.branch setting from workspace configurations in untrusted projects
Configure VS Code workspace trust settings to restrict extension functionality in untrusted folders

bash

# Update Ruby LSP gem to patched version
gem update ruby-lsp

# Or install specific patched version
gem install ruby-lsp -v '0.26.9'

# Verify installed version
gem list ruby-lsp