CVE-2025-66563 describes a cross-site scripting (XSS) vulnerability in Monkeytype versions 25.49.0 and earlier, stemming from improper handling of user-supplied input in the quote.text and quote.source fields. This flaw allows an attacker to inject and execute malicious JavaScript when a user views a specially crafted quote submission. The vulnerability carries a CVSS score of 6.1 (Medium), indicating a low attack complexity and requiring user interaction, but with the potential for low impact on confidentiality and integrity. An attacker could exploit this by crafting a malicious quote, which, when viewed, would execute arbitrary JavaScript in the victim's browser. Currently, there is no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 25.49.0CPE matchmatch criteria | cpe:2.3:a:monkeytype:monkeytype:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.