CVE-2026-34060: Ruby Gemfile Template Source Option Interpolation

A value is interpolated into a Ruby string that builds a Gemfile gem-source option (branch:/ref:/tag:). Generated Gemfiles are evaluated as Ruby by Bundler, so any attacker-controlled content in the interpolated value can break out of the string literal and execute arbitrary Ruby code at bundle composition time (see CVE-2026-34060 in ruby-lsp, where the ruby

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Ruby
greprules fetch cve-2026-34060-ruby-gemfile-template-source-option-interpolation --engine opengrep

Description

A value is interpolated into a Ruby string that builds a Gemfile gem-source option (branch:/ref:/tag:). Generated Gemfiles are evaluated as Ruby by Bundler, so any attacker-controlled content in the interpolated value can break out of the string literal and execute arbitrary Ruby code at bundle composition time (see CVE-2026-34060 in ruby-lsp, where the ruby