One new gist advisory

gems/gist/CVE-2026-105221.yml

@@ -0,0 +1,36 @@
+---
+gem: gist
+cve: 2026-105221
+ghsa: phqh-xp3p-h6mr
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-105221
+title: Gist (< 6.1.0) contains improper certificate validation vulnerability
+date: 2026-06-16
+description: |
+  The gist RubyGem before 6.1.0 contains an improper certificate
+  validation vulnerability that allows on-path attackers to intercept
+  HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE.
+  Attackers can present any certificate to read or modify GitHub API
+  traffic, stealing OAuth tokens and login credentials to read
+  and modify the victim's gists.
+cvss_v3: 7.4
+cvss_v4: 9.1
+unaffected_versions:
+  - ">= 2.0.0, < 4.0.0"
+patched_versions:
+  - ">= 6.1.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-105221
+    - https://rubygems.org/gems/gist/versions/6.1.0
+    - https://github.com/defunkt/gist/compare/v6.0.0...v6.1.0
+    - https://github.com/defunkt/gist/pull/374
+    - https://github.com/defunkt/gist/issues/373
+    - https://github.com/defunkt/gist/commit/07ccc1a6d46e9d36f0e85d0b1c5d795890ae6bcf
+    - https://github.com/defunkt/gist/blob/v6.0.0/lib/gist.rb#L466-L468
+    - https://www.vulncheck.com/advisories/gist-rubygem-before-6.1.0-disabled-tls-certificate-verification
+    - https://github.com/github/advisory-database/pull/10408
+    - https://github.com/advisories/GHSA-phqh-xp3p-h6mr
+notes: |
+  - cvss_v3 from GHSA and nvd.nist.gov URLs.
+  - cvss_v4 from nvd.nist.gov URL.
+  - ISS#373 says "Fixed and released in v6.1.0".