CVE-2026-105221: Defunkt Gist

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

Affected products

• Defunkt Gist: from 4.0.0, before 6.1.0 (fixed in 6.1.0)

Published 2026-10-04. Last modified 2026-10-06.