Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

defunkt/gist RubyGem lets HTTPS traffic be intercepted

CVE-2026-105221 · published 14 days ago
Summary

Versions of the defunkt/gist Ruby library older than 6.1.0 do not verify the security certificates used for HTTPS connections. This means a malicious actor on the network could read or change data sent to GitHub, including authentication tokens and login details. Update the library to version 6.1.0 or newer to restore proper certificate checking.

What to do
  • Update defunkt gist to version 6.1.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– defunkt gist < 6.1.0
Ubuntu:16.04:LTS canonical gist All versions
Original advisory text
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published4 Oct 2026
Updated17 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105221 · NVD
CVE-2026-105221 · MITRE
CVE-2026-105221 · OSV
UBUNTU-CVE-2026-105221 · OSV
Track software like this
Free during beta