CVE-2025-59838lowCWE-79

CVE-2025-59838: falha de baixa gravidade em monkeytypegame monkeytype

Monkeytype Vulnerable to Self-XSS on loading saved custom text

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar monkeytype

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.4epss 0.3%
Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Produtos afetados
monkeytypegame · monkeytype
CVEs relacionadas — monkeytypegame monkeytype

No mesmo produto, das mais perigosas para as menos.

CVE-2024-41127HIGHMonkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.EPSS 0.9%CVE-2026-69183HIGHMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)EPSS 0.5%CVE-2026-118762CRITICALMonkeytype: fork PR can execute code with elevated GITHUB_TOKENEPSS 0.3%CVE-2025-66563HIGHMonkeytype vulnerable to stored XSS in approve quotes pageEPSS 0.3%