Advisories · Technology
monkeytype.
Every CVE that names monkeytype among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.3 CriticalCritical · CVSS 9+
Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
- monkeytype
- CWE-829
- CVSS 7.5 High
Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
- monkeytype
- Authentication bypass
- CWE-644
- CVSS 7.1 High
Monkeytype vulnerable to stored XSS in approve quotes page
- monkeytype
- Cross-site scripting (XSS)
- CVSS 2.4 Low
Monkeytype Vulnerable to Self-XSS on loading saved custom text
- monkeytype
- Cross-site scripting (XSS)
- CVSS 8.4 High
Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.
- monkeytype
- Other injection