Gist RubyGem: Disabled TLS certificate verification

Summary

The gist RubyGem, a command-line client for uploading content to GitHub Gist, disables TLS certificate verification in its HTTPS connection code. An attacker positioned on the network path between the client and GitHub can present any certificate, intercept the traffic, and steal OAuth tokens or login credentials. With these, the attacker can read and modify the victim's gists. The attack requires an on-path position and does not affect the GitHub platform itself.

Affected

• gist RubyGem from 4.0.0 up to, but not including, 6.1.0
• Default configuration: unaffected according to the CNA record
• Vulnerable code: http_connection in lib/gist.rb sets VERIFY_NONE

Fixed in

• Upgrade to gist 6.1.0 or later
• The fix replaces the no-verification setting with peer verification (VERIFY_PEER)

Workaround

• Unknown. No vendor-approved workaround for the vulnerable versions was found.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, partial technical impact
• Not listed in the CISA KEV catalogue according to the sources found
• EPSS score about 0.2% (2026-10-06)
• Public proof-of-concept material may exist; sources conflict
• No confirmed exploitation in the wild found

Our recommendation

• Inventory systems with the gist gem, including Gemfile.lock entries, package-manager installs and CI jobs
• Upgrade to gist 6.1.0 or later in the next regular maintenance cycle
• Until upgraded, avoid using the gist client on untrusted networks such as public Wi-Fi
• If an on-path incident is suspected, rotate the GitHub tokens used by affected installations

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  abraxas/cve-2026-105221-gist-tls

Research sources

• CVE-2026-105221 OSV record osv.dev
• VulnCheck advisory: Gist RubyGem before 6.1.0 www.vulncheck.com
• Upstream fix commit github.com
• Upstream issue #373 github.com
• Vulnerable code at v6.0.0 github.com
• gist project repository github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:33.