# CVE-2026-34060: Shopify Ruby LSP code injection via workspace branch setting

Source: https://junglewise.ai/threats/cve-2026-34060-shopify-ruby-lsp-code-injection-via-workspace-branch-setting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-34060 · Severity: critical · CVSS 9.8 · Published 2026-03-31

Shopify's Ruby LSP is a tool used by developers to provide code intelligence features like autocomplete and error checking in editors like VS Code. A vulnerability allows a malicious project to execute arbitrary code on a developer's computer if they open a project containing a specially crafted configuration file. This could lead to a full system compromise, data theft, or unauthorized access to the developer's environment.

Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems), [Shopify](https://junglewise.ai/threats/vendors/shopify).

## Quick answers

**Is CVE-2026-34060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34060 being exploited in the wild.

**How severe is CVE-2026-34060?** Critical severity, with a CVSS score of 9.8, published 31 March 2026.

**Which products and versions are affected?** ruby-lsp (RubyGems) ECOSYSTEM:introduced=0,fixed=0.26.9.

**Is there a fix for CVE-2026-34060?** Yes. ruby-lsp (RubyGems): upgrade to 0.26.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34060 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-34060?** Check whether you run ruby-lsp (RubyGems), Shopify Ruby LSP (VS Code extension) or Shopify Ruby Lsp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ruby-lsp (RubyGems): upgrade to 0.26.9 or later

  ```sh
  bundle update ruby-lsp
  ```


## Technical details

A code injection vulnerability exists in Ruby LSP due to improper sanitization of the 'rubyLsp.branch' workspace setting. The server interpolates this setting directly into a generated Gemfile within the '.ruby-lsp/' directory. An attacker can craft a malicious '.vscode/settings.json' file containing Ruby code within the branch parameter; when a user opens the project and trusts the workspace, the LSP server generates the Gemfile and executes the injected code with the user's privileges. The issue is patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp gem version 0.26.9 by removing the branch setting and CLI flag.

## Affected products

- Shopify ruby-lsp < 0.26.9
- Shopify Shopify.ruby-lsp (VS Code extension) < 0.10.2

## Identifiers

- CVE-2026-34060
- GHSA-c4r5-fxqw-vh93

## Timeline

- 2026-03-25: patched: Fixes released in gem v0.26.9 and extension v0.10.2
- 2026-03-31: disclosed: CVE published to NVD

## References

- [https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9](https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9)
- [https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93](https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93)