Security Flaw in Monkeytype Involving Unauthorized Code Execution

CVE-2026-118762

What is CVE-2026-118762?

The vulnerability in Monkeytype's CI workflow prior to version 26.43.0 allows external contributors to execute arbitrary code through pull requests. This occurs due to the improper handling of GITHUB_TOKEN, which retains elevated permissions even after untrusted code executes. As a result, an attacker could manipulate repository content or modify pull requests and issues, potentially leading to data exfiltration and unauthorized changes within the repository. This issue has been resolved in version 26.43.0, which enhances security by eliminating these unnecessary permissions.

References