https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66563.htmlhttps://patchthecve.com/cve/CVE-2025-66563.htmlSun, 18 Oct 2026 15:10:00 +0000MEDIUM 6.1: Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straighttps://patchthecve.com/cve/CVE-2025-59838.htmlhttps://patchthecve.com/cve/CVE-2025-59838.htmlWed, 14 Oct 2026 20:15:18 +0000MEDIUM 5.4: Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.https://patchthecve.com/cve/CVE-2024-41127.htmlhttps://patchthecve.com/cve/CVE-2024-41127.htmlWed, 17 Jun 2026 07:47:19 +0000HIGH 8.3: Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Mo