Medium severity · published Dec 4, 2025
CVE-2025-66563
Monkeytype vulnerable to stored XSS in approve quotes page
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
monkeytype · monkeytypegame
<= 25.49.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66563
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66563
Patch
https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695
Exploit
https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27
More from monkeytype
9.6
CVE-2024-41127
Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.
9.3
CVE-2026-118762
Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
7.5
CVE-2026-69183
Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
5.4
CVE-2025-59838
Monkeytype Vulnerable to Self-XSS on loading saved custom text