---
id: "CVE-2026-118762"
kind: "vulnerability"
aliases: ["CVE-2026-118762"]
title: "Monkeytype: CI workflow lets forked pull requests run code with repository write token"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ci", "github-actions", "monkeytype", "other"]
not_affected_if: ["application-only-use", "workflow-not-present"]
published_at: "2026-10-29T17:18:07+00:00"
first_seen_at: "2026-10-29T17:26:17+00:00"
updated_at: "2026-10-29T17:27:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118762", "first_seen_at": "2026-10-29T17:26:17+00:00"}]
---

# Monkeytype: CI workflow lets forked pull requests run code with repository write token

A GitHub Actions workflow in the Monkeytype repository runs fork-controlled code with a write-scoped GITHUB_TOKEN when a pull request gets the format label. An outside contributor can use that to run code, read the token, and push changes or edit pull requests and issues in the repository.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `.github/workflows/fix-formatting.yml` in the repository and check whether it uses `pull_request_target`.
- Check the repository's installed version against `26.43.0`; versions below it are affected per the sources.

## Fix

- Upgrade to `26.43.0` or later, per the sources.

## Timeline

- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118762

## From the sources

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_