## ApostropheCMS: CAPTCHA response token not URL-encoded

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113667
- 公開日時: 2026-10-20T18:05:35.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-44qr-rrjg-2cqq)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-44qr-rrjg-2cqq

影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5, npm:@apostrophecms/login-recaptcha < 1.2.1 → 1.2.1, npm:@apostrophecms/login-hcaptcha < 1.3.0 → 1.3.0
Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.j…