CVE-2026-48122: Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious repository containing a .vscode/settings.json could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ruby LSP VS Code extensionto a version that resolves this vulnerability.Fixed in 0.10.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48122?
CVE-2026-48122 has a risk rating of 65, indicating a moderate severity level.
How do I fix CVE-2026-48122?
To fix CVE-2026-48122, update the Ruby LSP VS Code extension to version 0.10.4 or later.
What type of vulnerability is CVE-2026-48122?
CVE-2026-48122 is classified as an OS Command Injection vulnerability.
What impact does CVE-2026-48122 have on the Ruby LSP VS Code extension?
CVE-2026-48122 allows workspace settings to override critical executable and Gemfile paths, posing a security risk.
Who is affected by CVE-2026-48122?
Users of the Ruby LSP VS Code extension prior to version 0.10.4 are affected by CVE-2026-48122.