Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-118762: Monkeytype CI lets fork pull request run code with repo token

CVE-2026-118762 · published 7 days ago

Summary

The automated test that runs on pull requests could download and run code from an untrusted fork, giving the attacker access to the repository's secret token. With that token they could read, change or delete repository content and alter pull requests or issues. Update Monkeytype to version 26.43.0 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
monkeytypegame	monkeytype	< 26.43.0

Original advisory text

Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0.

References

https://github.com/monkeytypegame/monkeytype/commit/592ce1becb9b6824badc14a803bc... x_refsource_MISC
https://github.com/monkeytypegame/monkeytype/releases/tag/v26.43.0 x_refsource_MISC
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-1187... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-118762 Vendor Advisory
https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-47v3-j88w-... x_refsource_CONFIRM

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.3 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-829Inclusion of Functionality from Untrusted Control Sphere

Timeline

Published29 Oct 2026

Updated4 Nov 2026

First seen29 Oct 2026

Sources

CVE-2026-118762 · NVD

CVE-2026-118762 · MITRE

CVE-2026-118762 · OSV

GHSA-47v3-j88w-92f8 · GHSA

Track software like this

Free during beta