{"id":"GHSA-44qr-rrjg-2cqq","summary":"ApostropheCMS: CAPTCHA response token not URL-encoded","details":"**Summary**\nForm and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.\n\n**Details**\n- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`\n- `packages/login-recaptcha/index.js:44` — same pattern for login\n- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`\n\n**PoC**\n```\ninput.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'\n→ resulting verify URL:\n   https://www.google.com/recaptcha/api/siteverify?secret=\u003creal\u003e&response=attacker_token&secret=INJECTED_SECRET&something=1\n# (replicated exactly from recaptcha.js:39)\n```\n\n**Impact**\nLow: a crafted token smuggles extra `key=value` pairs (`secret`, extra `response`) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.\n\n**Remediation** — Build the verify request with `URL` + `searchParams` (or `encodeURIComponent` on both `secret` and `response`), and validate the token against `^[A-Za-z0-9._-]{1,2048}$` before use.","aliases":["CVE-2026-113667"],"modified":"2026-10-20T18:15:04.529028056Z","published":"2026-10-20T18:05:35Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-20T18:05:35Z","nvd_published_at":null,"cwe_ids":["CWE-116"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"},{"type":"PACKAGE","url":"https://github.com/apostrophecms/apostrophe"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"}],"affected":[{"package":{"name":"@apostrophecms/form","ecosystem":"npm","purl":"pkg:npm/%40apostrophecms/form"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-44qr-rrjg-2cqq/GHSA-44qr-rrjg-2cqq.json"}},{"package":{"name":"@apostrophecms/login-recaptcha","ecosystem":"npm","purl":"pkg:npm/%40apostrophecms/login-recaptcha"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-44qr-rrjg-2cqq/GHSA-44qr-rrjg-2cqq.json"}},{"package":{"name":"@apostrophecms/login-hcaptcha","ecosystem":"npm","purl":"pkg:npm/%40apostrophecms/login-hcaptcha"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-44qr-rrjg-2cqq/GHSA-44qr-rrjg-2cqq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}