CVE-2026-105221

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-04

Last updated on: 2026-10-06

Assigner: VulnCheck

Description

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105221

EUVD

EUVD-2026-92134

Affected Vendors & Products

Vendor	Product	Version / Range
defunkt	gist	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

The gist RubyGem before version 6.1.0 has a vulnerability where it does not properly validate SSL certificates. This allows attackers on the same network path to intercept HTTPS traffic by presenting any certificate. The issue is in the http_connection function in lib/gist.rb which sets VERIFY_NONE, disabling certificate checks.

Detection Guidance

Check if the gist RubyGem version is below 6.1.0 by running gem list gist. If installed, inspect the gem's source code for http_connection in lib/gist.rb with VERIFY_NONE settings.

Impact Analysis

Attackers can steal OAuth tokens and login credentials by intercepting GitHub API traffic. They can read or modify your gists without detection. This could lead to unauthorized access to your private data or spreading malicious content through your gist account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's privacy rules. Organizations may face compliance breaches if user data is exposed through this attack vector.

Mitigation Strategies

Update the gist RubyGem to version 6.1.0 or later using gem update gist. If updating is not possible, remove the gem immediately to prevent exposure.

Hi! I’m here to help you understand CVE-2026-105221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70