CVE-2026-105221: Improper Certificate Validation in defunkt gist

The gist RubyGem versions from 4.0.0 up to but not including 6.1.0 contain an improper certificate validation vulnerability. The vulnerability arises because the http_connection method in lib/gist.rb sets SSL verification to VERIFY_NONE, effectively disabling certificate validation. This allows attackers positioned on the network path to present any certificate and intercept or modify HTTPS traffic to the GitHub API. Successful exploitation can lead to theft of OAuth tokens and login credentials, enabling attackers to read and modify the victim's gists.

An attacker who can intercept network traffic can bypass SSL certificate validation, allowing them to read or modify sensitive data exchanged with the GitHub API. This includes stealing OAuth tokens and login credentials, which compromises the confidentiality and integrity of the victim's gists and potentially other GitHub resources accessible via those credentials.

A fix is available in gist RubyGem version 6.1.0 and later. Users should upgrade to version 6.1.0 or newer to resolve this vulnerability. No vendor advisory was provided, so patch status is based on the version range given. Until upgrading, avoid using vulnerable versions in untrusted network environments.