Is CVE-2026-34060 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34060 being exploited in the wild.

How severe is CVE-2026-34060?

Critical severity, with a CVSS score of 9.8, published 31 March 2026.

Which products and versions are affected?

ruby-lsp (RubyGems) ECOSYSTEM:introduced=0,fixed=0.26.9.

Is there a fix for CVE-2026-34060?

Yes. ruby-lsp (RubyGems): upgrade to 0.26.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34060 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34060?

Check whether you run ruby-lsp (RubyGems), Shopify Ruby LSP (VS Code extension) or Shopify Ruby Lsp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34060: Shopify Ruby LSP code injection via workspace branch setting

CVE-2026-34060 · Severity: critical · CVSS 9.8 · Published 2026-03-31

Shopify's Ruby LSP is a tool used by developers to provide code intelligence features like autocomplete and error checking in editors like VS Code. A vulnerability allows a malicious project to execute arbitrary code on a developer's computer if they open a project containing a specially crafted configuration file. This could lead to a full system compromise, data theft, or unauthorized access to the developer's environment.

Vendors: RubyGems, Shopify.

Quick answers

Is CVE-2026-34060 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34060 being exploited in the wild.
How severe is CVE-2026-34060?: Critical severity, with a CVSS score of 9.8, published 31 March 2026.
Which products and versions are affected?: ruby-lsp (RubyGems) ECOSYSTEM:introduced=0,fixed=0.26.9.
Is there a fix for CVE-2026-34060?: Yes. ruby-lsp (RubyGems): upgrade to 0.26.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34060 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34060?: Check whether you run ruby-lsp (RubyGems), Shopify Ruby LSP (VS Code extension) or Shopify Ruby Lsp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ruby-lsp (RubyGems): upgrade to 0.26.9 or later
```
bundle update ruby-lsp
```

Technical details

A code injection vulnerability exists in Ruby LSP due to improper sanitization of the 'rubyLsp.branch' workspace setting. The server interpolates this setting directly into a generated Gemfile within the '.ruby-lsp/' directory. An attacker can craft a malicious '.vscode/settings.json' file containing Ruby code within the branch parameter; when a user opens the project and trusts the workspace, the LSP server generates the Gemfile and executes the injected code with the user's privileges. The issue is patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp gem version 0.26.9 by removing the branch setting and CLI flag.

Affected products

Shopify ruby-lsp < 0.26.9
Shopify Shopify.ruby-lsp (VS Code extension) < 0.10.2

Identifiers

CVE-2026-34060
GHSA-c4r5-fxqw-vh93

Timeline

2026-03-25: patched: Fixes released in gem v0.26.9 and extension v0.10.2
2026-03-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.