CVE-2025-66563 Monkeytype vulnerable to stored XSS in approve quotes page
Attackers can execute malicious JavaScript on other users' browsers by submitting quotes containing HTML tags in the Monkeytype typing test application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-66563?
CVE-2025-66563 is a high-severity cross-site scripting vulnerability in monkeytypegame monkeytype, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).
Weakness: CWE-79
Which versions are affected by CVE-2025-66563?
It affects 1 product.
Products include Monkeytype Monkeytype.
How do I fix CVE-2025-66563?
No fix has been published for CVE-2025-66563 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-66563 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66563 exists.
Other vulnerabilities in monkeytypegame monkeytype
Sources
Also known as GHSA-mfjh-9552-8g27.