CVE-2026-105221: Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gist RubyGemto a version that resolves this vulnerability.Fixed in 6.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the gist RubyGem before version 6.1.0 are exposed when it communicates with the GitHub API over HTTPS. An attacker must be in a position to intercept that network traffic.
What does an attacker need to exploit the vulnerability?
The attacker needs on-path access to the victim's HTTPS connection to GitHub. No authentication or user interaction is required, but exploitation has high attack complexity.
What could an attacker obtain or change?
By presenting an arbitrary certificate, an on-path attacker can read or modify GitHub API traffic. This can expose OAuth tokens and login credentials and allow reading or modifying the victim's gists.
How can I determine whether my installation is affected?
Check the installed version of the gist RubyGem. Versions earlier than 6.1.0 are affected; version 6.0.0 contains the cited http_connection code that sets certificate verification to VERIFY_NONE.