All vulnerabilities
CVE-2026-113667GHSA-44qr-rrjg-2cqq

@apostrophecms/form: ApostropheCMS: CAPTCHA response token not URL-encoded

apostrophecms @apostrophecms/formnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.5.5Also 1.2.1, 1.3.0GitHub
Published20 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.5.5@apostrophecms/form, npmGitHubnpm install @apostrophecms/form@1.5.5
  • 1.2.1@apostrophecms/login-recaptcha, npmGitHubnpm install @apostrophecms/login-recaptcha@1.2.1
  • 1.3.0@apostrophecms/login-hcaptcha, npmGitHubnpm install @apostrophecms/login-hcaptcha@1.3.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.

Details

  • packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'
  • packages/login-recaptcha/index.js:44 — same pattern for login
  • packages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}'

PoC

input.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'
→ resulting verify URL:
   https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1
# (replicated exactly from recaptcha.js:39)

Impact Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.

Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.

Text from GitHub Advisory Database

Affected versions 10

  • @apostrophecms/form, npm< 1.5.5GitHub
  • @apostrophecms/login-recaptcha, npm< 1.2.1GitHub
  • @apostrophecms/login-hcaptcha, npm< 1.3.0GitHub
  • apostropheaffected: < 4.33.0CVE List
  • formaffected: < 1.5.5CVE List
  • login-hcaptchaaffected: < 1.3.0CVE List
  • login-recaptchaaffected: < 1.2.1CVE List
  • @apostrophecms/form, npmfrom first release, fixed in 1.5.5OSV
  • @apostrophecms/login-recaptcha, npmfrom first release, fixed in 1.2.1OSV
  • @apostrophecms/login-hcaptcha, npmfrom first release, fixed in 1.3.0OSV

References 5