CVE-2026-118762

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0.

• CWE-829

• https://github.com/monkeytypegame/monkeytype/commit/592ce1becb9b6824badc14a803bcd9268cbea382
• https://github.com/monkeytypegame/monkeytype/releases/tag/v26.43.0
• https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-47v3-j88w-92f8

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118757PiWeb Disable payment method / Partial payment for WooCommer…6.5
• CVE-2026-118758Kubeflow Pipelines enables users to build and deploy portabl…7.5
• CVE-2026-118759Kubeflow Pipelines enables users to build and deploy portabl…7.5
• CVE-2026-11876In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-dep…5
• CVE-2026-118760Kubeflow Pipelines enables users to build and deploy portabl…6.5
• CVE-2026-118761Kubeflow Pipelines enables users to build and deploy portabl…7.5
• CVE-2026-118763sigstore-js provides JavaScript libraries for interacting wi…7.4
• CVE-2026-118764minimatch is a minimal matching utility for converting glob …6.9
• CVE-2026-118765Botan is a C++ cryptography library. From 3.7.0 until 3.13.0…7.3
• CVE-2026-118766Botan is a C++ cryptography library. Prior to 3.13.0, Botan'…6.1
• CVE-2026-118767Botan is a C++ cryptography library. From 1.11.22 until 3.13…4.8
• CVE-2026-118768Botan is a C++ cryptography library. From 1.11.34 until 3.13…5.9