{"id":"ghsa-ghsa-44qr-rrjg-2cqq","seq":2423,"kind":"advisory","title":"ApostropheCMS: CAPTCHA response token not URL-encoded","url":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-44qr-rrjg-2cqq","summary":"影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5, npm:@apostrophecms/login-recaptcha < 1.2.1 → 1.2.1, npm:@apostrophecms/login-hcaptcha < 1.3.0 → 1.3.0\nSummary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.j…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-113667"],"tags":["GHSA-44qr-rrjg-2cqq","@apostrophecms/form","@apostrophecms/login-recaptcha","@apostrophecms/login-hcaptcha"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:05:35.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}