Vendor
Monkeytype versions prior to 26.43.0 contain a vulnerability in the .github/workflows/fix-formatting.yml CI workflow, which uses the pull_request_target trigger with repository write permissions. An external contributor whose pull request receives the format label can execute arbitrary code, read or exfiltrate the GITHUB_TOKEN, and modify repository content.