CVE-2025-66563

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695	Patch
https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27	Exploit Vendor Advisory
https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:monkeytype:monkeytype:*:*:*:*:*:*:*:*

History

18 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Monkeytype es una prueba de escritura minimalista y personalizable. En la versión 25.49.0 y anteriores, existe un manejo inadecuado de la entrada del usuario que permite a un atacante ejecutar javascript malicioso en cualquiera que vea un envío de cita malicioso. quote.text y quote.source son entrada del usuario, y se insertan directamente en el DOM. Si contienen etiquetas HTML, se renderizarán (después de cierto escape usando comillas y etiquetas textarea).

Information

Published : 2025-12-04 23:15

Updated : 2026-10-18 15:10

NVD link : CVE-2025-66563

Mitre link : CVE-2025-66563

CVE.ORG link : CVE-2025-66563

JSON object : View

Products Affected

monkeytype

monkeytype

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-66563", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66563", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T14:59:34.176595Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "monkeytypegame", "product": "monkeytype", "versions": [{"status": "affected", "version": "<= 25.49.0"}]}]}], "published": "2025-12-04T23:15:47.270", "references": [{"url": "https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags)."}, {"lang": "es", "value": "Monkeytype es una prueba de escritura minimalista y personalizable. En la versi\u00f3n 25.49.0 y anteriores, existe un manejo inadecuado de la entrada del usuario que permite a un atacante ejecutar javascript malicioso en cualquiera que vea un env\u00edo de cita malicioso. quote.text y quote.source son entrada del usuario, y se insertan directamente en el DOM. Si contienen etiquetas HTML, se renderizar\u00e1n (despu\u00e9s de cierto escape usando comillas y etiquetas textarea)."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monkeytype:monkeytype:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6ECFF90-451A-4F70-9378-C399D1B4512C", "versionEndIncluding": "25.49.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}