CVE-2025-66563CWE-79cross-site-scripting

CVE-2025-66563

Medium · published December 5, 2025

CVSS v3.1

6.1

EPSS

Percentile

14.1

In the wild

Unconfirmed

What it is

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00239 · 14.1th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-12-05T04:15Z

Affected products (1)

Product	Versions	Fixed in
monkeytype/monkeytype	≤ 25.49.0	—

References (3)

https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695 · [email protected]https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27 · [email protected]https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

04 DEC 22:34Z
Monkeytype vulnerable to stored XSS in approve quotes page
cvelistv5