Executive brief
Shopify's Ruby LSP is a tool used by developers to provide code intelligence features like autocomplete and error checking in editors like VS Code. A vulnerability allows a malicious project to execute arbitrary code on a developer's computer if they open a project containing a specially crafted configuration file. This could lead to a full system compromise, data theft, or unauthorized access to the developer's environment.
Technical details
A code injection vulnerability exists in Ruby LSP due to improper sanitization of the 'rubyLsp.branch' workspace setting. The server interpolates this setting directly into a generated Gemfile within the '.ruby-lsp/' directory. An attacker can craft a malicious '.vscode/settings.json' file containing Ruby code within the branch parameter; when a user opens the project and trusts the workspace, the LSP server generates the Gemfile and executes the injected code with the user's privileges. The issue is patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp gem version 0.26.9 by removing the branch setting and CLI flag.
Affected products
- Shopify ruby-lsp < 0.26.9
- Shopify Shopify.ruby-lsp (VS Code extension) < 0.10.2
Timeline
- 2026-03-25: patched: Fixes released in gem v0.26.9 and extension v0.10.2
- 2026-03-31: disclosed: CVE published to NVD