CVE-2026-105221

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105221", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-04T13:04:00.479Z", "datePublished": "2026-10-04T22:31:47.153Z", "dateUpdated": "2026-10-05T20:28:43.344Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-04T22:31:47.153Z"}, "datePublic": "2026-06-16T00:00:00.000Z", "title": "Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification", "descriptions": [{"lang": "en", "value": "The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "affected": [{"vendor": "defunkt", "product": "gist", "defaultStatus": "unaffected", "packageURL": "pkg:gem/gist", "versions": [{"version": "4.0.0", "lessThan": "6.1.0", "status": "affected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/defunkt/gist/issues/373", "tags": ["issue-tracking"], "name": "GitHub Issue #373"}, {"url": "https://github.com/defunkt/gist", "tags": ["product"]}, {"url": "https://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468", "tags": ["technical-description"]}, {"url": "https://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf", "tags": ["patch"]}, {"name": "VulnCheck Advisory: Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/gist-rubygem-before-6.1.0-disabled-tls-certificate-verification"}], "credits": [{"lang": "en", "value": "Siyang Wu", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T19:18:30.694491Z", "id": "CVE-2026-105221", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T20:28:43.344Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105221", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T19:18:30.694491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T19:18:31.627Z"}}], "cna": {"title": "Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification", "credits": [{"lang": "en", "type": "finder", "value": "Siyang Wu"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "defunkt", "product": "gist", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "6.1.0", "versionType": "semver"}], "packageURL": "pkg:gem/gist", "defaultStatus": "unaffected"}], "datePublic": "2026-06-16T00:00:00.000Z", "references": [{"url": "https://github.com/defunkt/gist/issues/373", "name": "GitHub Issue #373", "tags": ["issue-tracking"]}, {"url": "https://github.com/defunkt/gist", "tags": ["product"]}, {"url": "https://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468", "tags": ["technical-description"]}, {"url": "https://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/gist-rubygem-before-6.1.0-disabled-tls-certificate-verification", "name": "VulnCheck Advisory: Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-04T22:31:47.153Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105221", "state": "PUBLISHED", "dateUpdated": "2026-10-05T20:28:43.344Z", "dateReserved": "2026-10-04T13:04:00.479Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-04T22:31:47.153Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:gem/gist", "product": "gist", "vendor": "defunkt", "versions": [{"lessThan": "6.1.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists."}], "id": "CVE-2026-105221", "lastModified": "2026-10-06T16:08:43.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105221", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T19:18:30.694491Z", "version": "2.0.3"}}]}, "published": "2026-10-04T23:16:59.770", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/defunkt/gist"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/defunkt/gist/issues/373"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/gist-rubygem-before-6.1.0-disabled-tls-certificate-verification"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "gist: gist: Traffic interception and credential theft via improper TLS certificate validation", "id": "2545734", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545734"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.", "A flaw was found in gist. The utility completely disables Transport Layer Security (TLS) certificate verification when establishing HTTPS connections. An on-path attacker can exploit this flaw by presenting an arbitrary certificate to intercept, read, and manipulate network traffic. This can lead to information disclosure, including the theft of sensitive authentication tokens and credentials, and allow unauthorized modification of user data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-105221", "public_date": "2026-10-04T22:31:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105221\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105221\nhttps://github.com/defunkt/gist\nhttps://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468\nhttps://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf\nhttps://github.com/defunkt/gist/issues/373\nhttps://www.vulncheck.com/advisories/gist-rubygem-before-6.1.0-disabled-tls-certificate-verification"], "statement": "Red Hat has rated this issue as having a Critical security impact because an on-path adversary can intercept and tamper with encrypted communications without triggering TLS validation errors, leading to the theft of sensitive credentials and API tokens. This standalone command-line client is not shipped with core Red Hat Enterprise Linux offerings, confining exposure primarily to Fedora or developer installations where the utility is specifically installed. Successful exploitation requires an attacker to occupy a privileged position on the local network when requests are initiated by the client.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,6.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gist", "source": "cna", "vendor": "defunkt"}, "product": "gist", "vendor": "defunkt"}], "created": "2026-10-04T23:30:21.098837+00:00", "updated": "2026-10-06T21:10:03.003547+00:00", "vendors": ["defunkt", "defunkt$PRODUCT$gist"]}