{"id":"CVE-2026-118762","kind":"vulnerability","aliases":["CVE-2026-118762"],"related":[],"title":"Monkeytype: CI workflow lets forked pull requests run code with repository write token","description":"Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0.","summary":"A GitHub Actions workflow in the Monkeytype repository runs fork-controlled code with a write-scoped GITHUB_TOKEN when a pull request gets the format label. An outside contributor can use that to run code, read the token, and push changes or edit pull requests and issues in the repository.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","github-actions","monkeytype","other"],"not_affected_if":["application-only-use","workflow-not-present"],"how_to_check":"- Look for `.github/workflows/fix-formatting.yml` in the repository and check whether it uses `pull_request_target`.\n- Check the repository's installed version against `26.43.0`; versions below it are affected per the sources.","fix":"- Upgrade to `26.43.0` or later, per the sources.","status":"open","published_at":"2026-10-29T17:18:07+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","triaged_at":"2026-10-29T17:27:48+00:00","updated_at":"2026-10-29T17:27:48+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-29T17:27:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `26.43.0` or later, per the sources.","reach":"internet","title":"Monkeytype: CI workflow lets forked pull requests run code with repository write token","impact":"high","summary":"A GitHub Actions workflow in the Monkeytype repository runs fork-controlled code with a write-scoped GITHUB_TOKEN when a pull request gets the format label. An outside contributor can use that to run code, read the token, and push changes or edit pull requests and issues in the repository.","audience":"developers","category":"other","nicknames":[],"who_cares":["monkeytype","github-actions","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Outside contributor runs code and pushes repository content with write token","analyst_note":"Confirm the fixed release in the Monkeytype GitHub advisory and whether the label requirement is the only trigger; sources were NVD only.","how_to_check":"- Look for `.github/workflows/fix-formatting.yml` in the repository and check whether it uses `pull_request_target`.\n- Check the repository's installed version against `26.43.0`; versions below it are affected per the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["application-only-use","workflow-not-present"],"who_is_affected":"This affects the Monkeytype repository's own CI workflow, not the Monkeytype application or user data. Teams that run or fork the Monkeytype repository and rely on that workflow are the ones to look at; teams that only use the hosted typing test are not exposed by this issue according to the sources.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4256,"output_tokens":585,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118762':16A,19A '-2026':15A,18A '26.43.0':87C,185C 'action':23B,27B 'actions/checkout':122C 'affect':167C 'applic':175C 'arbitrari':148C 'binari':120C 'chang':67B 'check':100C 'ci':2A,20B,170C 'code':9A,37B,61B,134C,149C 'configur':130C 'content':158C 'contributor':55B,138C 'control':36B,118C 'customiz':82C 'cve':14A,17A 'data':178C 'depend':107C 'edit':69B 'elev':125C 'execut':135C 'exfiltr':152C 'extern':137C 'fix':182C 'fork':5A,35B,103C,110C,117C 'fork-control':34B,116C 'format':51B,144C 'get':49B 'git':129C 'github':22B,26B,43B,126C 'github-act':21B 'github/workflows/fix-formatting.yml':89C 'instal':106C 'invok':114C 'issu':73B,164C,166C,180C 'label':52B,145C 'let':4A 'minimalist':80C 'modifi':160C 'monkeytyp':1A,24B,31B,77C,174C 'outsid':54B 'oxfmt':119C 'package.json':112C 'permiss':99C 'persist':123C 'prior':85C 'pull':6A,47B,70B,93C,104C,140C,161C 'push':66B,156C 'read':62B,150C 'receiv':142C 'repositori':11A,32B,76B,97C,157C,169C 'request':7A,48B,71B,94C,105C,141C,162C 'run':8A,33B,60B,91C,147C 'scope':42B 'target':95C 'test':84C 'token':13A,44B,64B,127C,154C 'type':83C 'untrust':133C 'use':57B 'user':177C 'version':184C 'whose':139C 'workflow':3A,28B,90C,171C 'write':12A,41B,98C 'write-scop':40B","nicknames":[],"mitigations":[],"who_affected":"This affects the Monkeytype repository's own CI workflow, not the Monkeytype application or user data. Teams that run or fork the Monkeytype repository and rely on that workflow are the ones to look at; teams that only use the hosted typing test are not exposed by this issue according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T17:18:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118762","severity":null,"published_at":"2026-10-29T17:18:07+00:00","modified_at":"2026-10-29T17:18:07+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}