Monkeytype CVE-2025-66563

Exploitation requires the attacker to submit a quote whose quote.text or quote.source fields contain HTML/script, and requires a victim (a quote approver/moderator, since the vulnerable sink is the quote-approve.ts approval modal) to actually view the pending submission - this passive user interaction (UI:P) is the primary limiting factor. The flaw affects Monkeytype 25.49.0 and earlier where these fields are inserted into the DOM with only partial escaping (quotes/textarea boundaries); it is fully remediated in the patched build that wraps both fields in escapeHTML(). Realistic exploitation also depends on the attacker being able to submit quotes, which typically requires an authenticated Monkeytype account, narrowing it from purely anonymous abuse.

Signals converge on a genuine but low-urgency stored XSS (CWE-79) in Monkeytype. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H) yields 7.1 (High), reflecting network reachability, low complexity, and high confidentiality impact once triggered, but it is tempered by required passive user interaction (UI:P) - a victim must view the malicious quote submission. EPSS is only 0.05% (16th percentile), indicating very low probability of broad opportunistic exploitation, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. A public exploit reference exists via the GitHub Security Advisory (GHSA-mfjh-9552-8g27), and the fix is confirmed by the vendor patch commit, so the technical pathway is fully documented and verifiable from source. CONFLICT/CAVEAT: the vendor vector uses PR:N (unauthenticated), but the vulnerable code path is the quote-approval modal (quote-approve.ts) and submitting a quote on Monkeytype realistically requires an authenticated account, so true exploitation likely needs attacker-side authentication (PR:L) - verify account/submission requirements with the vendor. Net: a legitimate client-side security bug worth patching, but not an emergency given low EPSS, no KEV, required interaction, and a narrow victim population (quote approvers/moderators).

An attacker submits a quote to Monkeytype with HTML/JavaScript payloads embedded in the quote.text or quote.source fields, which are inserted directly into the DOM of the quote-approval interface. When a moderator or user viewing pending quote submissions opens the approval modal, the injected script executes in their browser session, enabling session/token theft or actions on their behalf. A public advisory (GHSA-mfjh-9552-8g27) documents the issue and the fixing commit demonstrates the exact unescaped sinks.