Monaco Editor

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime XSS 50 % Code execution 20 % Info disclosure 20 % Parsing/validation 5 % Latest advisories Loading the feed Overview Monaco is the editor component extracted from VS Code and pulled about 7.9 million times a week from npm, and it is the default answer whenever a web application needs a real code editor: cloud provider consoles, low-code and workflow builders, database and query tools, API playgrounds, documentation sites and browser-based IDEs all embed it. Its blast radius is unusual because it is almost always rendering content somebody else influenced, a shared document, a saved query, a checked-in config file, inside an authenticated first-party origin, so an editor-rendering injection becomes a session-level compromise of whatever product embedded it. Zero CVEs against a footprint that size is an argument that it is under-researched, not that it is sound. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program; note that the XSS row tops out at $8,000 for a high-quality Critical report, and only deserialization or code injection reaches the $15,000 headline. sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of microsoft/monaco-editor , which the program names on its SCOPE list as "Monaco-editor", at Critical or Important severity on the most recent actively maintained branch, with local-machine-only impact payable because Microsoft names Monaco in the carve-out The editor core: the text model, the view layer, and everything the editor puts into the host page's DOM The widget layer, hover, completion, signature help, code lens, inline suggestion and peek, together with the markdown rendered inside any of them The web worker boundary between the editor and its language services, and the protocol they speak across it Language configuration, tokenisation and Monarch grammar handling, plus the JSON, CSS, HTML and TypeScript worker services Microsoft ships alongside the editor The public editor API and everything it exposes to an embedding application: options, commands, actions, keybindings and contribution points The published monaco-editor npm package, its ESM and AMD builds, and the GitHub Actions workflows that release them Out of scope Bugs only reachable through a host application's own misuse of the editor API Third-party language plugins and grammars that Microsoft does not ship Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing Moderate and Low severity, which pay $0 at every report quality Samples, tutorials, quickstart code and samples/ directories Documentation-only issues Publicly disclosed issues and dependency-confusion reports Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Code injection across the web worker boundary between the editor and its language services, where a crafted document drives execution in the host page rather than in the worker: this is the class carrying the $15,000 top band and the only route here above the $8,000 XSS ceiling Script execution out of hover, completion, signature-help or code-lens widget rendering, which is the classic Monaco XSS shape and lands in the $8,000 Critical band Markdown rendered inside an editor widget escaping into script, since almost every embedding surfaces attacker-influenced markdown through documentation hovers A javascript: or data: URL surviving link rendering and firing inside the embedding application's authenticated origin Monarch grammar or tokenisation handling that lets document content break out of the token stream and into the rendered DOM Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. XSS, the dominant class here, is capped at $8,000 for a Critical high-quality report; the $15,000 band is reserved for deserialization of untrusted data and code injection Only Critical and Important severity qualify; Moderate and Low findings pay $0 under this program Reproduce on the most recent actively maintained branch, against the editor itself rather than a host application's wiring Local-machine-only impact is payable here, because Monaco Editor is named in the program's local-machine carve-out Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC, which holds the detail until a fixed release of the monaco-editor package is out and then publishes its own advisory with researcher credit. Microsoft requires submissions stay confidential while it prepares that fix, so hold your write-up until the advisory is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability