CVE-2026-48122

Received Received - Intake

Code Execution via Malicious VS Code Settings in Ruby LSP Extension

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-48122

Affected Vendors & Products

Vendor	Product	Version / Range
ruby_lsp	vs_code_extension	0.10.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Ruby LSP is a language server protocol implementation for Ruby. The vulnerability exists in the Ruby LSP VS Code extension before version 0.10.4. Workspace settings in a malicious repository could override paths to Ruby executables, version managers, or Gemfiles. Opening such a repository would execute code with the developer's privileges.

Detection Guidance

Check if the Ruby LSP VS Code extension version is below 0.10.4 by inspecting the extension details in VS Code. Look for a .vscode/settings.json file in repositories for suspicious workspace-level settings that override Ruby executable paths or Gemfile locations.

Impact Analysis

If you open a malicious repository in VS Code with the vulnerable Ruby LSP extension, an attacker could execute arbitrary code on your system with your user privileges. This could lead to data theft, malware installation, or further compromise of your development environment.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches that violate GDPR or HIPAA. Organizations may face compliance violations if sensitive data is exposed due to this exploit.

Mitigation Strategies

Update the Ruby LSP VS Code extension to version 0.10.4 or later. Review and remove any untrusted .vscode/settings.json files in repositories. Avoid opening or trusting repositories from untrusted sources.

Hi! I’m here to help you understand CVE-2026-48122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70