monkeytypegame monkeytype

• CVE-2026-118762 Critical 9.3 Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN 0.3%
• CVE-2026-69183 High 7.5 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass) 0.5%
• CVE-2025-66563 High 7.1 Monkeytype vulnerable to stored XSS in approve quotes page 0.3%
• CVE-2025-59838 Low 2.4 Monkeytype Vulnerable to Self-XSS on loading saved custom text 0.3%
• CVE-2024-41127 High 8.4 Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access. 0.9%