CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
An on-path attacker can intercept HTTPS traffic to steal OAuth tokens and credentials by exploiting disabled TLS certificate verification in the Gist RubyGem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105221?
CVE-2026-105221 is a critical vulnerability in defunkt gist, published on 4 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
Weakness: CWE-295
Which versions are affected by CVE-2026-105221?
How do I fix CVE-2026-105221?
No fix has been published for CVE-2026-105221 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105221 being exploited?
There is no known exploitation of CVE-2026-105221 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-phqh-xp3p-h6mr, UBUNTU-CVE-2026-105221.