CVE-2026-105221
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: partial
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
Affected versions
- defunkt gist
From 4.0.0 · fixed in 6.1.0