CVE-2026-118762 in Monkeytype
Summary
by MITRE • 10/29/2026
Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in GitHub Actions workflows for the Monkeytype project represents a critical supply chain risk inherent to the use of pull_request_target triggers combined with insufficient isolation of untrusted code execution environments. Prior to version 26.43.0, the repository's CI workflow configured under .github/workflows/fix-formatting.yml was set to execute on the pull_request_target event type while possessing write permissions for the repository contents. This configuration creates a dangerous attack vector because the pull_request_target trigger runs in the context of the base branch and with elevated privileges, yet it checks out the code from the head of the pull request submitted by an external contributor. When such a workflow is labeled to run formatting tools, it proceeds to checkout the forked repository's source code, install dependencies defined in that untrusted package.json file, and subsequently invoke binaries provided by the contributor, specifically the oxfmt tool.
The core technical flaw lies in how the GitHub Actions runner handles authentication tokens during this process. The GITHUB_TOKEN is persisted in Git configuration with elevated permissions before the untrusted code from the pull request is executed. This means that any arbitrary script or binary invoked as part of the dependency installation or execution phase has immediate access to credentials capable of modifying repository content, pushing changes, and altering issues or pull requests. An external contributor who submits a pull request tagged with the specific format label can therefore craft malicious code within their forked package.json or oxfmt binary that exfiltrates the GITHUB_TOKEN or performs unauthorized write operations against the main repository. This effectively bypasses standard security boundaries designed to protect open source projects from compromised contributors, as the workflow grants trust to untrusted input before verifying its safety.
From an operational impact perspective, this vulnerability allows for code injection and potential compromise of the project's integrity rather than direct exploitation of end-user software or user data. The Monkeytype application itself remains unaffected because the flaw exists strictly within the automated CI/CD pipeline infrastructure used by maintainers to manage contributions. However, the ability for a contributor to exfiltrate tokens poses significant risks including credential theft and potential pivoting into other systems if those credentials have broader access scopes. Furthermore, an attacker could push malicious commits or modify existing pull requests and issues, thereby undermining developer trust and potentially introducing backdoors into future releases through legitimate-looking contribution channels. This scenario aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, as well as CWE-269 Improvement of Privileges, where untrusted input leads to unauthorized elevation of access within the CI environment.
To mitigate this class of vulnerability, organizations and open source maintainers must adhere strictly to secure GitHub Actions practices by avoiding the use of pull_request_target when interacting with untrusted code that requires elevated permissions. Instead, workflows should utilize the pull_request event type which runs in a restricted context without write access unless explicitly granted after verification steps are completed securely. If privileged actions are necessary for formatting or linting, they must be performed on checked-out base branch code rather than the contributor's forked version. Additionally, dependencies from untrusted sources should never be installed directly within workflows that hold sensitive tokens; instead, pre-vetted tools should be used via pinned versions and isolated execution contexts. This issue was resolved in Monkeytype version 26.43.0 by adjusting these workflow configurations to prevent the persistence of elevated credentials during the execution of contributor-supplied code, thereby aligning with ATT&CK technique T1587 Development Compromises where attackers exploit development infrastructure to establish footholds or modify artifacts before deployment.