CVE-2026-48122: Ruby LSP VS Code Extension RCE Vulnerability

CVE-2026-48122 Overview

CVE-2026-48122 affects the Ruby LSP VS Code extension, an implementation of the Language Server Protocol for Ruby. Versions prior to 0.10.4 allow a malicious repository to override the path to the Ruby executable, version manager executables, or the Bundler Gemfile used at startup. An attacker crafts a .vscode/settings.json file that redirects these workspace-level settings to attacker-controlled targets. Opening and trusting the repository executes code with the privileges of the developer. The underlying ruby-lsp gem and clients in other editors are not affected. Version 0.10.4 of the extension resolves the issue.

Critical Impact
A trusted malicious workspace can achieve local code execution as the developer user through overridden executable paths in the Ruby LSP VS Code extension.

Affected Products

Ruby LSP VS Code extension versions prior to 0.10.4
Visual Studio Code installations with the extension enabled
Developer workstations that open untrusted Ruby repositories

Discovery Timeline

2026-08-07 - CVE-2026-48122 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48122

Vulnerability Analysis

The Ruby LSP VS Code extension reads workspace-level configuration from .vscode/settings.json when a project is opened and trusted. Several of these settings control the path to executables invoked during language server startup, including the Ruby interpreter, the version manager binary, and the Bundler Gemfile reference. The extension consumed these values without restricting them to trusted, user-scoped configuration. A repository author can therefore ship a settings.json that redirects these paths to a script bundled inside the repository. Once the developer trusts the workspace, the extension launches the attacker-controlled binary during initialization, resulting in command execution [CWE-78] under the developer's account.

Root Cause

The root cause is improper trust separation between workspace-scoped settings and executable path configuration. Settings that determine which binary to spawn should be sourced from user or machine scope, not from the repository. Because the extension honored workspace overrides for these fields, attacker-supplied JSON directly influenced process creation arguments.

Attack Vector

Exploitation requires a developer to clone a malicious repository, open it in VS Code, and grant workspace trust. The attacker embeds a payload script in the repository and points the Ruby executable, version manager, or Bundler Gemfile setting at that script. When the Ruby LSP extension activates for the workspace, it invokes the attacker's binary. See the GitHub Security Advisory GHSA-2x7g-8mp4-572w for the technical write-up.

Detection Methods for CVE-2026-48122

Indicators of Compromise

Presence of .vscode/settings.json in a repository that sets rubyLsp.rubyExecutablePath, rubyLsp.rubyVersionManager.executablePath, or rubyLsp.bundleGemfile to a repository-relative path
Executable files checked into .vscode/, .bundle/, or other repository directories referenced by workspace settings
Unexpected child processes spawned by Code.exe or code shortly after opening a Ruby workspace

Detection Strategies

Scan repositories and code review pull requests for .vscode/settings.json files that override executable paths
Alert on process launches where the parent is VS Code and the child executable resides inside a user workspace directory
Monitor endpoint telemetry for Ruby LSP extension invocations that reference non-standard interpreter paths

Monitoring Recommendations

Enable command-line auditing on developer workstations to capture process arguments from VS Code child processes
Review VS Code extension host logs for Ruby LSP startup entries showing overridden binary paths
Track workspace trust prompts across managed developer endpoints to identify newly trusted external repositories

How to Mitigate CVE-2026-48122

Immediate Actions Required

Upgrade the Ruby LSP VS Code extension to version 0.10.4 or later on all developer workstations
Audit recently opened Ruby repositories for malicious .vscode/settings.json files and untrusted executables
Revoke workspace trust for any repository whose provenance cannot be confirmed

Patch Information

The maintainers fixed the issue in Ruby LSP VS Code extension version 0.10.4 by restricting which settings can be sourced from workspace scope. Refer to the Shopify ruby-lsp security advisory for release details.

Workarounds

Do not grant workspace trust to Ruby repositories from unknown authors until the extension is updated
Configure Ruby interpreter and version manager paths in user or machine scope only, and disable workspace-level overrides where possible
Open untrusted repositories in VS Code Restricted Mode to prevent extension activation

bash

# Verify the installed Ruby LSP VS Code extension version
code --list-extensions --show-versions | grep -i ruby-lsp

# Update to the patched release
code --install-extension Shopify.ruby-lsp --force