Cpe:2.3:a:monkeytype:monkeytype:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amonkeytypemonkeytype/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:10:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMonkeytype: Arbitrary code execution in CI workflow (CVE-2026-118762)https://feed.craftedsignal.io/briefs/2026-10-monkeytype-ci-rce/Thu, 29 Oct 2026 21:10:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-monkeytype-ci-rce/Monkeytype versions prior to 26.43.0 contain a vulnerability in the .github/workflows/fix-formatting.yml CI workflow, which uses the pull_request_target trigger with repository write permissions. An external contributor whose pull request receives the format label can execute arbitrary code, read or exfiltrate the GITHUB_TOKEN, and modify repository content.<p>The Monkeytype repository CI workflow, specifically .github/workflows/fix-formatting.yml, is vulnerable to arbitrary code execution. Prior to version 26.43.0, the workflow runs on pull_request_target with write permissions and installs dependencies from fork-controlled files. Because actions/checkout persists the GITHUB_TOKEN while untrusted code executes, attackers can exfiltrate the token or perform unauthorized repository actions. This issue affects the CI pipeline, not the Monkeytype application or user data.</p> criticaladvisory