Monkeytype
Monthly
Arbitrary code execution inside Monkeytype's 'fix-formatting' GitHub Actions workflow (versions prior to 26.43.0) lets an external contributor run attacker-controlled code in a CI job that holds a repository-scoped GITHUB_TOKEN with contents:write and pull-requests:write, allowing commits, tags, and pull-request or issue edits to be pushed to monkeytypegame/monkeytype. The workflow triggers on pull_request_target, checks out the fork's head commit, installs dependencies from the fork's package.json, and then invokes the fork-supplied oxfmt binary while actions/checkout leaves persist-credentials at its default true, so the token sits in .git/config and is readable or exfiltratable by that binary. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), so no attacker account or privileges are required, but a maintainer must apply the 'format' label to the malicious PR before the job runs; a public PoC reference exists in the form of the advisory's reproduction steps, and it is not verified here as working exploit code. Impact is confined to the repository and CI infrastructure, not the live monkeytype.com application, its database, or user accounts, and the vendor has released 26.43.0 as the fix.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Monkeytype 25.49.0 and earlier renders attacker-controlled quote submission fields (quote.text and quote.source) directly into the DOM inside the quote-approval modal, so HTML/script payloads survive the partial quote/textarea escaping and execute in the browser of the moderator reviewing the pending quote. This is a stored cross-site scripting (CWE-79) issue in a client-side TypeScript frontend, and publicly available exploit code exists, though exploitation requires a victim moderator to open the approval view (UI:P) and, per the assessed vector, an attacker account able to submit quotes (PR:L). Risk is real but low-urgency: EPSS is 0.05% (16th percentile) and the flaw is not listed in CISA KEV.
Monkeytype is a minimalistic and customizable typing test. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity. Public exploit code available.
Monkeytype is a minimalistic and customizable typing test. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary code execution inside Monkeytype's 'fix-formatting' GitHub Actions workflow (versions prior to 26.43.0) lets an external contributor run attacker-controlled code in a CI job that holds a repository-scoped GITHUB_TOKEN with contents:write and pull-requests:write, allowing commits, tags, and pull-request or issue edits to be pushed to monkeytypegame/monkeytype. The workflow triggers on pull_request_target, checks out the fork's head commit, installs dependencies from the fork's package.json, and then invokes the fork-supplied oxfmt binary while actions/checkout leaves persist-credentials at its default true, so the token sits in .git/config and is readable or exfiltratable by that binary. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), so no attacker account or privileges are required, but a maintainer must apply the 'format' label to the malicious PR before the job runs; a public PoC reference exists in the form of the advisory's reproduction steps, and it is not verified here as working exploit code. Impact is confined to the repository and CI infrastructure, not the live monkeytype.com application, its database, or user accounts, and the vendor has released 26.43.0 as the fix.
Rate-limit bypass in Monkeytype ≤ 26.26.0 allows unauthenticated remote attackers to neutralize all request throttling protections by rotating client-controlled `cf-connecting-ip` or `x-forwarded-for` HTTP headers, with each rotated value creating an independent rate-limit bucket and resetting the window. The affected middleware in `backend/src/middlewares/rate-limit.ts` trusts these client-supplied headers over Express's trust-proxy-derived `req.ip`, rendering `rootRateLimiter`, `badAuthRateLimiter`, `getKey()`, and `getKeyWithUid()` ineffective. Practical consequences include mail-bombing registered users via the `/users/forgotPasswordEmail` and `verificationEmail` endpoints, exhausting Firebase or SMTP quotas affecting all users, and evading brute-force credential protections. No public exploit has been identified at time of analysis; no fixed version is available.
Monkeytype 25.49.0 and earlier renders attacker-controlled quote submission fields (quote.text and quote.source) directly into the DOM inside the quote-approval modal, so HTML/script payloads survive the partial quote/textarea escaping and execute in the browser of the moderator reviewing the pending quote. This is a stored cross-site scripting (CWE-79) issue in a client-side TypeScript frontend, and publicly available exploit code exists, though exploitation requires a victim moderator to open the approval view (UI:P) and, per the assessed vector, an attacker account able to submit quotes (PR:L). Risk is real but low-urgency: EPSS is 0.05% (16th percentile) and the flaw is not listed in CISA KEV.
Monkeytype is a minimalistic and customizable typing test. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity. Public exploit code available.
Monkeytype is a minimalistic and customizable typing test. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.