CVE-2026-34060 (ruby-lsp): Ruby LSP has arbitrary code execution through branch setting
    
    
      
        







...

The RubyLA blog offers insights, tutorials, and community updates for Ruby developers in Los Angeles and beyond. Developers can explore Ruby language features, web development frameworks, and best practices for building Ruby applications. Additionally, the blog covers Ruby meetups, events, and job opportunities in the Los Angeles area, fostering collaboration and networking within the local Ruby community.

RUBYLAND

A critical security vulnerability (CVSS 9.8) in the ruby-lsp gem allows arbitrary Ruby code execution. The rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, meaning opening a malicious repository containing a crafted .vscode/settings.json could execute code with the user's privileges. The fix removes the branch setting entirely. VS Code extension users should be on >= 0.10.2 and gem users should update to >= 0.26.9.