Read the docs
TI-2026-67696 Aliases CVE-2026-105221GHSA-phqh-xp3p-h6mr

Disabled TLS certificate verification in gist RubyGem

Priority LOW 39CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

The gist RubyGem from 4.0.0 before 6.1.0 does not verify TLS certificates, because its http_connection method sets VERIFY_NONE. An on-path attacker can present any certificate to intercept HTTPS traffic to the GitHub API, stealing OAuth tokens and login credentials and reading or modifying the victim's gists. This is tracked as CWE-295.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00226 13th percentileScored 2026-11-07
Fix Fixed gist (defunkt): 6.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
defunktgist4.0.0 to before 6.1.06.1.0Patch availableCNA
  • gist Vendordefunkt Affected 4.0.0 to before 6.1.0 Fixed in 6.1.0 Patch available CNA

Remediation

Upgrade the gist RubyGem to version 6.1.0. CVSS 4.0 vector shows high confidentiality and integrity impact with no exploitation reported.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA gist (defunkt) Fixed in 6.1.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-105221
  2. 2026-10-05 Alias added: GHSA-phqh-xp3p-h6mr
  3. 2026-10-05 Priority changed: MEDIUM → LOW
  4. 2026-10-06 CISA SSVC decision points changed
  5. 2026-10-06 Affected versions changed · Red Hat
  6. 2026-10-06 CVSS score added · Red Hat

References

Patch 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences