monkeytypegame monkeytype güvenlik açıkları (CVE)

monkeytypegame monkeytype için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

4 sonuç

9.3Kritik

CVE-2026-118762 13 gün önce

Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

monkeytypegame monkeytype

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's…

7.5Yüksek

CVE-2026-69183 2 ay önce

Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

monkeytypegame monkeytype

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived…

7.1Yüksek

CVE-2025-66563 11 ay önce

Monkeytype vulnerable to stored XSS in approve quotes page

monkeytypegame monkeytype

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source ar…

2.4Düşük

CVE-2025-59838 1 yıl önce

Monkeytype Vulnerable to Self-XSS on loading saved custom text

monkeytypegame monkeytype

Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.