shopify ruby-lsp vulnerabilities

Latest shopify ruby-lsp CVEs

Newest publication first

1. CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

   Published 2026-08-07

   Medium·CVSS 5.4 EPSS 0.18%

   Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at start...

2. CVE-2026-34060 Ruby LSP has arbitrary code execution through branch setting

   Published 2026-03-31

   High·CVSS 7.1 EPSS 0.50% PoC

   Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.