CVE-2026-118762

Summary

The GitHub Actions workflow .github/workflows/fix-formatting.yml in Monkeytype prior to v26.43.0 executes untrusted forked code with elevated repository write permissions due to improper handling of the GITHUB_TOKEN, allowing an attacker to run arbitrary code and exfiltrate credentials.

Exploitability

Exploitation requires an external contributor to submit a pull request that receives the 'format' label, triggering the vulnerable workflow with repository write access.

Blast radius

Successful exploitation allows the attacker to push malicious commits, modify issues or pull requests, and potentially compromise repository integrity and CI/CD supply chain trust.

Detection

Monitor GitHub Actions workflow runs for unexpected execution of fork-provided binaries (e.g., oxfmt) in workflows triggered by pull_request_target with repository write permissions; look for anomalous Git pushes or token usage in workflow logs.

Prioritized remediation

Upgrade Monkeytype to version 26.43.0 or later, which fixes the workflow to avoid persisting the elevated GITHUB_TOKEN before untrusted code execution.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.