{"id":"GHSA-44qr-rrjg-2cqq","revision":"e3906903776b400498da7094818e9c00","records":[{"revision":"e3906903776b400498da7094818e9c00","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-44qr-rrjg-2cqq","aliases":["CVE-2026-113667"],"title":"ApostropheCMS: CAPTCHA response token not URL-encoded","description":"**Summary**\nForm and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.\n\n**Details**\n- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`\n- `packages/login-recaptcha/index.js:44` — same pattern for login\n- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`\n\n**PoC**\n```\ninput.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'\n→ resulting verify URL:\n   https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1\n# (replicated exactly from recaptcha.js:39)\n```\n\n**Impact**\nLow: a crafted token smuggles extra `key=value` pairs (`secret`, extra `response`) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.\n\n**Remediation** — Build the verify request with `URL` + `searchParams` (or `encodeURIComponent` on both `secret` and `response`), and validate the token against `^[A-Za-z0-9._-]{1,2048}$` before use.","state":0,"publishedAt":"2026-10-20T18:05:35+00:00","modifiedAt":"2026-10-20T18:15:04.5290281+00:00","affected":[{"ecosystem":"npm","name":"@apostrophecms/form","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.5.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@apostrophecms/login-recaptcha","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.2.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@apostrophecms/login-hcaptcha","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"],"sourceUrl":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-44qr-rrjg-2cqq","identifiers":["GHSA-44qr-rrjg-2cqq","CVE-2026-113667"]},"retained":false,"historicalAffected":[]}],"coverage":[]}