---
id: CVE-2026-48122
title: Ruby LSP is an implementation of the language server protocol for Ruby
summary: >-
  Ruby LSP is an implementation of the language server protocol for Ruby.
  Several workspace-level settings in the Ruby LSP VS Code extension prior to
  version 0.10.4 could override the path to the Ruby executable, the version
  manager execut…
severity: none
cwe:
  - CWE-78
published: '2026-08-07'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:05:53.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48122'
references:
  - url: >-
      https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-2x7g-8mp4-572w
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0018
epssPercentile: 0.06711
ingestedAt: '2026-09-18T20:51:25.597Z'
---

## Overview

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.