What is CVE-2025-66563?

CVE-2025-66563 is a medium-severity vulnerability in Monkeytype, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-12-04.

How severe is CVE-2025-66563?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Monkeytype

CVE-2025-66563

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (11.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Monkeytype
Monkeytypegame Monkeytype — versions <= 25.49.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-66563?: CVE-2025-66563 is a medium-severity vulnerability in Monkeytype, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-12-04.
How severe is CVE-2025-66563?: Medium severity. CVSS v3 base score is 6.1 out of 10.