CVE-2026-118762 Details
Description
Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0.
A vulnerability in the Monkeytype GitHub repository's CI workflow prior to version 26.43.0 allows external contributors to execute arbitrary code with elevated permissions. This issue arises because the .github/workflows/fix-formatting.yml workflow runs on pull_request_target events with repository write permissions. The workflow checks out the PR author's fork, installs dependencies from the fork's package.json, and executes a binary controlled by the fork, all while leaving a write token embedded in the Git configuration. As a result, a PR author can manipulate the workflow to run malicious code and access sensitive tokens, which could be used to push changes to the repository or modify pull requests and issues.
Users can update to Monkeytype version 26.43.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-47v3-j88w-92f8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/monkeytypegame/monkeytype/commit/592ce1becb9b6824badc14a803bcd9268cbea382 | [email protected] | Source CodeVendor |
| https://github.com/monkeytypegame/monkeytype/releases/tag/v26.43.0 | [email protected] | Release NotesVendor |
| https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-47v3-j88w-92f8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Monkeytype | < 26.43.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |