Description
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| defunkt | gist | 4.0.0 – < 6.1.0 | 6.1.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gist | No fix yet | — |
| Ubuntu 26.04 LTS | gist | No fix yet | — |
| Ubuntu 24.04 LTS | gist | No fix yet | — |
| Ubuntu 22.04 LTS | gist | No fix yet | — |
| Ubuntu 20.04 LTS | gist | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | gist | No fix yet | — |
| Ubuntu 16.04 LTS | gist | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
abraxas/cve-2026-105221-gist-tls ★ 0 · Oct 6, 2026
CVE-2026-105221 - gist RubyGem - High - MITM - GitHub OAuth token theft
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Issue #373 issue-tracking
- https://github.com/defunkt/gist product
- https://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468 technical-description
- https://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf patch
- VulnCheck Advisory: Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification third-party-advisory