CVE-2025-59838

MediumCVSS 5.4/10Last modified Oct 14, 2026

Description

Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
monkeytypegame	monkeytype	< 25.44.0

References

https://github.com/monkeytypegame/monkeytype/commit/42f6a16c6255d66cbb2be279131454866d98f2c9Patch
https://github.com/monkeytypegame/monkeytype/commit/f025b121cbe437e29de432b4aa72e0de22c755b7Patch
https://github.com/monkeytypegame/monkeytype/releases/tag/v25.44.0Release Notes
https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774wExploit, Vendor Advisory
https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774wExploit, Vendor Advisory

Timeline

Published: Sep 25, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-598395.4The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips CVE-2025-59845.4A vulnerability has been found in SourceCodester Online Student Clearance System 1.0 and classified as problematic. Affected by this vulnera CVE-2025-598408.1Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to CVE-2025-598419.8Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles se CVE-2025-598424.3jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to ver CVE-2025-598435.3Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user CVE-2025-598447.7SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerabil CVE-2025-598458.2Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbo CVE-2025-598476.8HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a CVE-2025-598486.8HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a us CVE-2025-598496.1Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the e CVE-2025-59857.3A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown