Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.

published 2024-08-02 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-38940

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact to the steps.pr_num_reader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0.

Patch / fix

fixed in 1 links 1

monkeytype monkeytype 24.30.0

github.com/monkeytypegame/monkeytype@29627fd commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-08-02)

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

securitylab.github.com https://securitylab.github.com/advisories/GHSL-2024-167_monkeytype referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

monkeytypegame monkeytype
monkeytype monkeytype

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-94 Improper Control of Generation of Code

References

github.com /monkeytypegame/monkeytype/commit/29627fd0d5f152e2da59671987090ea0a5c29874
patch
securitylab.github.com /advisories/GHSL-2024-167_monkeytype
exploit, third-party-advisory
github.com /monkeytypegame/monkeytype/security/advisories/GHSA-wcjf-5464-4wq9
vendor-advisory

Sources

CVE List CVE-2024-41127
NVD CVE-2024-41127

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary