PT-2025-49173 · Unknown · Monkeytype

Leonabcd123 · Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-66563

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Monkeytype versions prior to 25.49.0

Description The software exhibits improper handling of user input, potentially allowing an attacker to execute malicious JavaScript code on users who view a malicious quote submission. The quote.text and quote.source inputs are directly inserted into the Document Object Model (DOM) without sufficient sanitization. This allows HTML tags within these inputs to be rendered, potentially leading to cross-site scripting (XSS).

Recommendations Versions prior to 25.49.0 should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66563

GHSA-MFJH-9552-8G27

Affected Products

Monkeytype

References · 7

• 🔥 https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66563.json · Exploit
• https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66563 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66563 · Vendor Advisory
• https://t.me/CVEtracker/38882 · Telegram Post
• https://twitter.com/CVEnew/status/1996713919830745306 · Twitter Post