Shopify ruby-lsp, an implementation of the language server protocol for Ruby, had a vulnerability (CWE-94) where the rubyLsp.branch VS Code workspace setting was unsafely interpolated into a generated Gemfile without sanitization. This flaw permitted arbitrary Ruby code execution triggered by opening a project with a crafted .vscode/settings.json file. The vulnerability affects versions before 0.10.2 (Shopify.ruby-lsp) and 0.26.9 (ruby-lsp). The issue has been addressed in the specified patched versions.

An attacker who can cause a user to open a malicious project with a specially crafted .vscode/settings.json file can execute arbitrary Ruby code on the user's system. This could lead to compromise of the user's environment with the privileges of the user running the ruby-lsp process. The CVSS 4.0 score is 7.1 (high), reflecting the potential for significant impact through local code execution requiring user interaction.

Users should upgrade to Shopify.ruby-lsp version 0.10.2 or ruby-lsp version 0.26.9 or later, where this vulnerability has been patched. No other mitigations are specified or required once patched. Patch status is confirmed by the vendor advisory embedded in the description.