Monkeytype CVE-2026-118762

Exploitation requires that the target repository run the vulnerable .github/workflows/fix-formatting.yml, which triggers on pull_request_target with contents:write and pull-requests:write permissions, checks out the fork PR's head, installs dependencies from the fork's package.json, and then invokes the fork-sourced 'oxfmt' binary while actions/checkout leaves persist-credentials at its default (true), embedding the GITHUB_TOKEN in .git/config. The decisive attacker prerequisite is control of their own fork's package.json (trivially satisfied). The key LIMITING factor is that a repository maintainer with triage/write access must apply the 'format' label to the attacker's PR (UI:R) - the workflow only runs on that labeled event - so the attack cannot proceed without that human action; note that --ignore-scripts does NOT mitigate it because it only suppresses npm/pnpm lifecycle hooks, not a package's declared bin entry invoked by name.

This is a genuine high-priority issue, not a CVSS-inflated one, but its risk is scoped to the Monkeytype GitHub repository and CI infrastructure - not the live monkeytype.com application, its database, or user accounts, which the advisory explicitly rules out. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) aligns well with the mechanism: a remote, unauthenticated external contributor (PR:N) triggers a classic GitHub Actions 'Pwn Request' with low complexity (AC:L), but exploitation requires a maintainer to apply the 'format' label (UI:R), and the compromise of the CI runner then affects a separate security authority - the repository and its write-scoped GITHUB_TOKEN - justifying the scope change (S:C). The vuln.today Decision label is act_now, and a vendor patch plus detailed GHSA advisory with reproduction steps are published. No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active exploitation in the wild; the act_now urgency rests on the high technical impact, the published mechanism/PoC, and the trivial attacker-side effort rather than on observed attacks. The one meaningful limiter is the UI:R dependency on a maintainer labeling the PR - exploitation is not fully autonomous.

An external contributor opens a pull request against monkeytypegame/monkeytype whose fork contains a malicious package.json that replaces the 'oxfmt' devDependency with an attacker-controlled binary. When a maintainer applies the 'format' label, the pull_request_target workflow checks out the fork, installs its dependencies, and invokes 'pnpm oxfmt', executing the attacker's code inside a CI job that holds a contents:write + pull-requests:write GITHUB_TOKEN. The GHSA advisory includes working reproduction steps that demonstrate the bin-execution mechanism locally (with simulated token exfiltration); they are a proof-of-concept of the trigger rather than a packaged against-production exploit.