CVE-2026-48122

Name of the Vulnerable Software and Affected Versions Ruby LSP VS Code extension versions prior to 0.10.4

Description Workspace-level settings in the extension can be manipulated via a .vscode/settings.json file in a malicious repository. An attacker can override the path to the Ruby executable, version manager executables, or the Bundler Gemfile used during startup. If a developer opens and trusts such a repository, arbitrary code can be executed with the developer's privileges.

Recommendations Update Ruby LSP VS Code extension to version 0.10.4.