Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-105221

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
Back to all
CVE

CVE-2026-105221

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.1
-
4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
0
-
C
H
U
-

Related Resources

No items found.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105221.json, https://nvd.nist.gov/vuln/detail/CVE-2026-105221, https://www.vulncheck.com/advisories/gist-rubygem-before-6.1.0-disabled-tls-certificate-verification, https://github.com/defunkt/gist/issues/373, https://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf, https://github.com/defunkt/gist, https://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468

Severity

0

CVSS Score
0
10

Basic Information

Base CVSS
0
EPSS Probability
0.00226%
EPSS Percentile
0.13439%
Introduced Version
d6de1c47b2549b00e1d26c08eaefce962c9390b1,0
Fix Available
07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading