CVE Alert: CVE-2026-105221 – defunkt

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim’s gists.

**Risk verdict:** High-impact credential and data-integrity risk, but exploitation requires an attacker to be positioned on the network path; KEV, SSVC, PoC and EPSS status are not provided, so urgency cannot be fully calibrated.

**Why this matters:** A successful interception could expose API credentials and enable unauthorised reading or alteration of users’ hosted content. The principal concern is account and data compromise rather than service outage; stolen credentials may also be reused where organisations have weak token controls.

**Most likely attack path:** An attacker must be able to intercept or influence the connection between an application using the Ruby library and the remote API. No privileges or user action are required, but the on-path condition makes opportunistic remote exploitation less likely. Scope is unchanged, so direct impact appears limited to the affected account and data, though exposed credentials could create follow-on access.

**Who is most exposed:** Environments running Ruby scripts, developer tooling, or automation that uses this gem to access hosted snippets are most relevant. Risk rises where those processes run on untrusted networks or hold long-lived, broadly scoped credentials.

dependency inventories, lockfiles and build artefacts for affected gem installations.

Review proxy and endpoint logs for unexpected API destinations, certificate errors, or unusual TLS inspection.

Audit API-token use for unfamiliar source addresses, unexpected reads, edits, or token creation.

Check whether exposed credentials were used outside their normal automation patterns.

Mitigation and prioritisation

Upgrade to the corrected release; verify the resolved dependency is deployed across hosts and build pipelines.

Revoke and rotate potentially exposed tokens, then review their permissions and access history.

Until upgraded, prevent untrusted network-path access and use trusted egress controls; do not treat this as a substitute for remediation.

Test changes in representative automation before broad deployment, and confirm TLS verification is enabled.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.