Ruby LSP CVE-2026-48122

Q: What is the CVSS score of CVE-2026-48122?

CVE-2026-48122 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

OS Command Injection (CWE-78)

2026-08-07 security-advisories@github.com

Command Injection

5.4

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector because the malicious repo must be on the developer's machine; PR:N as the attacker needs no privileges on the target system; UI:R for mandatory workspace trust action; S:U as execution stays within the developer's session.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 23:31 vuln.today

DescriptionCVE.org

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious repository containing a .vscode/settings.json could set these values to attacker-controlled targets. Opening and trusting the repository would then execute code with the privileges of the developer. The Ruby LSP gem and clients of the language server in other editors are not affected. Version 0.10.4 of the Ruby LSP VS Code extension fixes the issue.

AnalysisAI

Arbitrary code execution in the Ruby LSP VS Code extension prior to version 0.10.4 is achievable by any attacker who can deliver a malicious repository to a developer. Workspace-level settings in .vscode/settings.json were trusted by the extension to configure the Ruby executable path, version manager binaries, and Bundler Gemfile - all of which the extension invokes at startup - allowing an attacker-controlled repository to redirect those invocations to arbitrary binaries. The Ruby LSP gem and language server clients in other editors are explicitly not affected; no public exploit has been identified at time of analysis, and a vendor fix is available in version 0.10.4.

Technical ContextAI

The Ruby LSP VS Code extension (Shopify/ruby-lsp) implements the Language Server Protocol for Ruby, spawning a background Ruby process to provide IDE capabilities such as autocompletion, diagnostics, and code navigation. VS Code's workspace settings mechanism allows .vscode/settings.json files in a repository root to override user and default settings at the project level. The extension trusted these workspace settings to resolve critical OS-level executable paths - the Ruby binary, version manager executables (rbenv, rvm, chruby, mise, etc.), and the Bundler Gemfile path - without sanitizing or validating the configured values. This maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-controlled data (repository settings) flowed directly into OS process invocations, constituting classic command injection at the path-resolution layer. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:A) confirms the local attack surface, the presence of specific triggering conditions, and the requirement for active user interaction.

Affected ProductsAI

The Ruby LSP VS Code extension (published by Shopify) in all versions prior to 0.10.4 is affected. The Ruby LSP gem itself and language server clients for other editors (Neovim, Emacs, etc.) are explicitly confirmed as not affected. No CPE strings were provided in the available intelligence; affected version range is confirmed by the vendor advisory at https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-2x7g-8mp4-572w.

RemediationAI

Upgrade the Ruby LSP VS Code extension to version 0.10.4 or later via the VS Code Extensions Marketplace, which removes the ability for workspace-level .vscode/settings.json to override executable paths used by the extension. As an interim measure for developers who cannot immediately update, VS Code's built-in Restricted Mode should be enabled by default so that workspace settings are not applied until the developer explicitly trusts the workspace - this gives an opportunity to review .vscode/settings.json before any extension processes launch. Developers may also manually inspect .vscode/settings.json for unexpected rubyLsp.* settings keys before trusting any unfamiliar repository. Note that Restricted Mode prompts add friction to legitimate development workflows. The vendor advisory is at https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-2x7g-8mp4-572w.