Shopify/ruby-lsp

Shopify/ruby-lsp

GitHubGitHub
GitHubgithub.com
shopify.github.ioshopify.github.io
Releases286
Frequency5 days 9 hours
Last Release
Stars2.01K
An opinionated language server for Ruby
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2026-34060↗
9.8 CRITICAL—

Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.