Published
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package vscode-extensions.shopify.ruby-lsp
- @LeSuisse accepted
- @LeSuisse published on GitHub
Ruby LSP has arbitrary code execution through branch setting
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9.
References
-
https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93 x_refsource_CONFIRM
-
https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9 x_refsource_MISC
Affected products
ruby-lsp
- ==< 0.26.9
Shopify.ruby-lsp
- ==< 0.10.2
Matching in nixpkgs
pkgs.ruby-lsp
None
pkgs.rubyPackages.ruby-lsp
None
pkgs.rubyPackages_3_1.ruby-lsp
None
pkgs.rubyPackages_3_2.ruby-lsp
None
pkgs.rubyPackages_3_3.ruby-lsp
None
pkgs.rubyPackages_3_4.ruby-lsp
None