Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-41127— Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.

Quick assessment

Affected
monkeytypegame monkeytype
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Monkeytype是Monkeytype开源的一种简约且可定制的打字测试。 Monkeytype 24.30.0之前版本存在安全漏洞，该漏洞源于容易受到代码注入攻击，攻击者能够获得拉请求写入访问权限。

CVSS 8.4 · High EPSS 0.88% · P56
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-41127

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.
Source: CVE Program / CVE List V5
Vulnerability Description
Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact to the steps.pr_num_reader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Monkeytype 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Monkeytype是Monkeytype开源的一种简约且可定制的打字测试。 Monkeytype 24.30.0之前版本存在安全漏洞，该漏洞源于容易受到代码注入攻击，攻击者能够获得拉请求写入访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
monkeytypegame monkeytype < 24.30.0 -

II. Public POCs for CVE-2024-41127

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9087 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2024-41127

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-41127 (1)

Vendor Advisories for CVE-2024-41127 (1)

Other References for CVE-2024-41127 (1)

IV. Related Vulnerabilities

Same product: monkeytype
Same vendor: monkeytypegame
Same weakness: CWE-74

V. Comments for CVE-2024-41127

No comments yet

Leave a comment