CVE-2025-66563: fallo de gravedad alta en monkeytypegame monkeytype
Monkeytype vulnerable to stored XSS in approve quotes page
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
monkeytypegame · monkeytypeCVEs relacionadas — monkeytypegame monkeytype
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-41127HIGHMonkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.EPSS 0.9%CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.5%CVE-2026-118762CRITICALMonkeytype: fork PR can execute code with elevated GITHUB_TOKENEPSS 0.3%CVE-2025-59838LOWMonkeytype Vulnerable to Self-XSS on loading saved custom textEPSS 0.3%