CVE-2024-41127: falha de alta gravidade em monkeytypegame monkeytype
Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.9%
Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact to the steps.pr_num_reader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
monkeytypegame · monkeytypeCVEs relacionadas — monkeytypegame monkeytype
No mesmo produto, das mais perigosas para as menos.
CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.5%CVE-2026-118762CRITICALMonkeytype: fork PR can execute code with elevated GITHUB_TOKENEPSS 0.3%CVE-2025-66563HIGHMonkeytype vulnerable to stored XSS in approve quotes pageEPSS 0.3%CVE-2025-59838LOWMonkeytype Vulnerable to Self-XSS on loading saved custom textEPSS 0.3%