CVE-2026-48122 Shopify CVE debrief

Who should care

Developers and administrators using the Ruby LSP VS Code extension, especially those working with Ruby projects, should assess their exposure and update to version 0.10.4 or later to mitigate the vulnerability.

Why it matters

CVE-2026-48122 is a vulnerability in the Ruby LSP VS Code extension that allows a malicious repository to override workspace-level settings, potentially leading to code execution. Developers and administrators should assess their exposure, update to version 0.10.4 or later, and review repository settings to mitigate the vulnerability.

• Potential code execution with developer privileges
• Repository settings override vulnerability
• Version 0.10.4 or later required for fix

Technical summary

The Ruby LSP VS Code extension prior to version 0.10.4 had a vulnerability where several workspace-level settings could be overridden by a malicious repository, potentially leading to code execution with the privileges of the developer. The vulnerability arises from the extension's ability to execute code with developer privileges when a malicious repository containing a `.vscode/settings.json` file is opened and trusted. The issue impacts developers and administrators using the Ruby LSP VS Code extension, especially those working with Ruby projects.

Defensive priority

Assess exposure in Ruby LSP VS Code extension deployments, verify version 0.10.4 or later, and review repository settings.

Recommended defensive actions

• Review and update Ruby LSP VS Code extension to version 0.10.4 or later
• Assess exposure in Ruby LSP VS Code extension deployments
• Verify repository settings and restrict malicious repository access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Ruby LSP VS Code extension prior to version 0.10.4 had several workspace-level settings that could override the path to the Ruby executable, version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing a `.vscode/settings.json` could set these values to attacker-controlled targets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.