CVE-2026-34060 in ruby-lsp
요약 (영어)
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.
Be aware that VulDB is the high quality source for vulnerability data.
책임이 있는
GitHub_M
예약하다
2026. 03. 25.
공개
2026. 03. 31.
상태
확인됨
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 354304 | Shopify ruby-lsp settings.json 권한 상승 | 94 | 정의되지 않음 | 공식 수정 | CVE-2026-34060 |