{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/monkeytype/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:monkeytype:monkeytype:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-118762"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Monkeytype (\u003c 26.43.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Monkeytype"],"content_html":"\u003cp\u003eThe Monkeytype repository CI workflow, specifically .github/workflows/fix-formatting.yml, is vulnerable to arbitrary code execution. Prior to version 26.43.0, the workflow runs on pull_request_target with write permissions and installs dependencies from fork-controlled files. Because actions/checkout persists the GITHUB_TOKEN while untrusted code executes, attackers can exfiltrate the token or perform unauthorized repository actions. This issue affects the CI pipeline, not the Monkeytype application or user data.\u003c/p\u003e\n","date_modified":"2026-10-29T21:10:06Z","date_published":"2026-10-29T21:10:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-monkeytype-ci-rce/","summary":"Monkeytype versions prior to 26.43.0 contain a vulnerability in the .github/workflows/fix-formatting.yml CI workflow, which uses the pull_request_target trigger with repository write permissions. An external contributor whose pull request receives the format label can execute arbitrary code, read or exfiltrate the GITHUB_TOKEN, and modify repository content.","title":"Monkeytype: Arbitrary code execution in CI workflow (CVE-2026-118762)","url":"https://feed.craftedsignal.io/briefs/2026-10-monkeytype-ci-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Monkeytype","version":"https://jsonfeed.org/version/1.1"}