RCE in Shopify Ruby-lsp
CVE-2026-48122
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executab…
Vulnerability class: Command Injection (OS Command Injection)
Affected products
- Shopify Ruby-lsp — versions < 0.10.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)