CVE-2026-105221
High
Description
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
SeverityHigh
CVSS7.4
Exploit probability—
Product
Defunkt Gist
PublishedOct 4, 2026
First seenOct 4, 2026
Weakness typeCWE-295CWE-295
How to fix
Update
- defunkt gist6.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| defunkt gist | 4.0.0 ≤ v < 6.1.0 | 6.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.