CVE-2025-59838lowCWE-79

CVE-2025-59838: fallo de gravedad baja en monkeytypegame monkeytype

Monkeytype Vulnerable to Self-XSS on loading saved custom text

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear monkeytype

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.4epss 0.3%
Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Productos afectados
monkeytypegame · monkeytype
CVEs relacionadas — monkeytypegame monkeytype

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-41127HIGHMonkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.EPSS 0.9%CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.5%CVE-2026-118762CRITICALMonkeytype: fork PR can execute code with elevated GITHUB_TOKENEPSS 0.3%CVE-2025-66563HIGHMonkeytype vulnerable to stored XSS in approve quotes pageEPSS 0.3%