MO
Product
monkeytype
5
CVEs
0
On KEV
9.6
Max CVSS
1
New 30D
Severity mix
Critical 2High 1Medium 2Low 0
Watch
Add monkeytype to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-41127 | 9.6 | Aug 2 | Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access. Affected: < 24.30.0 |
| CVE-2026-118762 New | 9.3 | Oct 29 | Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN Affected: < 26.43.0 |
| CVE-2026-69183 | 7.5 | Aug 20 | Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass) Affected: <= 26.26.0 |
| CVE-2025-66563 | 6.1 | Dec 4 | Monkeytype vulnerable to stored XSS in approve quotes page Affected: <= 25.49.0 |
| CVE-2025-59838 | 5.4 | Sep 25 | Monkeytype Vulnerable to Self-XSS on loading saved custom text Affected: < 25.44.0 |
Showing 5