CVE-2026-118762

Name of the Vulnerable Software and Affected Versions Monkeytype versions prior to 26.43.0

Description The .github/workflows/fix-formatting.yml workflow runs on pull request target with repository write permissions. It checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because the actions/checkout action persists the elevated GITHUB TOKEN in the Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can execute arbitrary code. This allows the attacker to read or exfiltrate the token, push repository content, or modify pull requests and issues. This issue affects the repository CI workflow rather than the application or user data.

Recommendations Update to version 26.43.0.